ConTraGAN - A conditional transformer-based generative adversarial network for zero-day network attack analysis and detection

The Domain Name Service (DNS) protocol has become a sophisticated tool for malicious actors to bypass network firewalls and Intrusion Detection Systems (IDS) for cybercrimes, such as exfiltrating stolen data through tunnelled DNS traffic. This paper proposes a solution, named as ConTraGAN, to generate unknown zero-day network attack vectors for the purpose of training IDS and detecting malicious traffic. The ConTraGAN encompasses a hybrid conditional transformer-based generative adversarial network model and is trained using exfiltrated data that are tunnelled over DNS traffic. A self-attention mechanism is also built into the ConTraGAN, which serves as a module of providing attention weights to each feature of the captured DNS traffic. The preliminary results show that the proposed network can function as an effective generator of new attack vectors for IDS training and detection.