NetGenRL

Introduction

NetGenRL is a sequence adversarial generation network based on reinforcement learning, which is designed for labeled network traffic generation.

Setup

NetGenRL is written under Python 3.12. Following Python package is needed before running.

• pytorch == 2.5.1
• numpy
• scipy
• gensim

Run

Data preparation

• Put training data (pcap format) into subfolder of pcap folder (data-pcap default)
• Make sure pcap files in training data is named as "[label].pcap"
  • An example of training data structure is following:

data-pcap
└── iscx
    ├── bittorrent.pcap
    ├── email.pcap
    ├── facebook.pcap
    ├── ftps.pcap
    ├── netflix.pcap
    ├── skype.pcap
    ├── spotify.pcap
    ├── vimeo.pcap
    ├── voipbuster.pcap
    └── youtube.pcap

Configuration editing

• Edit configuration in config.json, the meaning of field is following:
  • path: folder path to get and save data (except for the folder where the training data is located, all other folders can be automatically generated)
    • dataset: name of training dataset, also the name of subfolder under training data folder
    • pcap_folder: training data folder
    • json_folder: json fommat training data folder (convert in pre-processing)
    • bins_folder: folder of bins
    • wordvec_folder: folder of word vector model
    • model_folder: folder of trained generation model
    • result_folder: folder to save generation model
  • model_paras: hyper-parameters of generation model
  • attributes: packet attributes of network traffic to generate. If users want to add or change attributes, the code of pre\_process/pcap\_process.py should be modified.

Run code

• Run code with python driver.py
• The json fommat of generation data can be found in result_folder
  • The generated traffic is a JSON list, with each item representing a bidirectional flow.
  • A flow includes src/dst ip and src/dst port, "series" of other packet level attributes.
  • Reverse data packets are represented by signed packet lengths.
  • "time" represents the time interval of the packet, and the first packet defaults to 0.