AnchorMixGAN: Anchor-Aligned Generative Semi-Supervision for DDoS Detection in Cloud-Integrated IoT Networks

Jin Yang; Xufeng Liu; Yong Hu; Xueyang Wang; Honglu Yang; Gang Li

cs.LGSep 26, 2026

AnchorMixGAN: Anchor-Aligned Generative Semi-Supervision for DDoS Detection in Cloud-Integrated IoT Networks

Authors: Jin Yang, Xufeng Liu, Yong Hu, Xueyang Wang, Honglu Yang, Gang Li

Organizations: School of Cyber Science and Engineering, Sichuan University, Chengdu, 610207, China · College of Information Science and Technology, Xizang University, Lhasa, 850000, China · Shaanxi Key Laboratory of Intelligent Policing, Shaanxi Police College, Xi’an, 710021, China · China Academy of Transportation Sciences, Ministry of Transport of the People’s Republic of China, Beijing, 100029, China ·

Abstract

Detecting distributed denial-of-service (DDoS) attacks in cloud-integrated IoT networks is difficult when labeled traffic is scarce. Generative semi-supervised learning can supplement the available training data, but prediction shifts induced by synthetic views may affect the targets assigned to real unlabeled flows. We propose AnchorMixGAN, a generative semi-supervised framework that addresses this problem through anchor-aligned target construction. Its Anchor-MAS module treats each real unlabeled flow as an anchor and creates alternative views by replacing one field group at a time with values from generated traffic. A frozen reference classifier predicts the anchor and its views; averaging and sharpening these predictions produces a soft target for the original flow. The flow and its target are then mixed with a labeled example using MixUp, allowing the detector to learn from both the original labeled records and the mixed examples. We analyze how reference-classifier error, view construction, and sharpening affect the target, and derive a bound on the resulting change in cross-entropy at a fixed detector prediction. At the reported 90% training setting with 20% of the training records labeled, AnchorMixGAN attains accuracies of 97.3%, 97.4%, and 96.5% on NSLKDD, BoT-IoT, and CICIoT2023, respectively, exceeding the corresponding MixGAN results by 1.6, 1.0, and 4.4 percentage points.

Figures & tables

Figure 1: DDoS threat scenario in a cloud-integrated IoT system.

Figure 2: Overall architecture of the 1-D WideResNet backbone.

Figure 3: Overview of AnchorMixGAN. (1) Generated donor groups replace complete groups of a real unlabeled anchor; unselected fields are retained. (2) One frozen reference classifier evaluates the complete anchor and two views. Its predictions are averaged and sharpened to form the cached soft target

q_{A}(u)

. (3) The complete anchor and its target are mixed with a labeled record and its label, using the same coefficient for features and targets. (4) One shared detector learns from labeled and mixed examples with

\mathcal{L}=\tfrac{1}{2}\mathcal{L}_{sup}+\tfrac{1}{2}\mathcal{L}_{mix}

; only detector parameters are updated. Repeated symbols across panels denote the same records and targets. Five field groups and the substituted positions are illustrative;

K=2

views are shown. Reference classifier probabilities are abbreviated as

p(\cdot)

. Only fitted preprocessing and the trained detector are deployed.

// Step 1: Construct anchor-dependent targets

Train

f_{\theta_{t}}

\mathcal{D}_{l}

; freeze in evaluation mode.

Select

N_{l}=|\mathcal{D}_{l}|

real anchors and fix the pairs

(x_{i},u_{i})

for

i=1,\ldots,N_{l}

Sample

K

donors

g_{ik}\in\mathcal{P}

and whole-group masks

M_{ik}

v_{ik}\leftarrow(1-M_{ik})\odot u_{i}+M_{ik}\odot g_{ik}

\bar{q}_{i}\leftarrow\big[p_{\theta_{t}}(u_{i})+\sum_{k=1}^{K}p_{\theta_{t}}(v_{ik})\big]/(K+1)

Algorithm 1 AnchorMixGAN training

Figure 4: Performance comparison on NSL-KDD (top row) and BoT-IoT (bottom row) at training data ratios of 60%–90%. Columns show accuracy, TPR, and TNR, respectively. Curves correspond to the values in Table 1 , with AnchorMixGAN highlighted in red. All panels use the same vertical scale.

$\alpha$	$T$	Accuracy (%)
0.40	0.7	96.16
0.75	0.7	96.93
0.90	0.7	95.82
0.75	0.3	96.85
0.75	0.5	97.37

Table 4: Impact of

\alpha

and

T

on BoT-IoT Detection Performance (90% Training Data)

Labeling Ratio	Accuracy	TPR	TNR
1%	0.926	0.926	0.933
5%	0.944	0.944	0.945
10%	0.957	0.957	0.956
20%	0.974	0.973	0.974

Table 5: Effect of Labeling Ratio on BoT-IoT Detection Performance (90% Training Data)

Network Intrusion Detection

Network intrusion detection identifies malicious or abnormal network activity to help protect computers, connected devices, and critical infrastructure.

See all 165 papers

Cognitive Graph Intelligence for Adaptive and Robust DDoS Attack Detection in Next Generation Networks
Aug 18, 2026Mohammad Arif Hossain, Yeahia Sarker, Md Jafrin Hossain +2Network Intrusion Detection Generative Adversarial Networks
Middle Tennessee State University, USA · C2C Tech, Germany · New Jersey Institute of Technology, USA
Synthetic Network Packet Generation through Statistical Learning and Genetic Algorithms
Jun 18, 2026Mayank Raj, Nathaniel D. Bastian, Lance Fiondella +1Synthetic Data Generation Synthetic Tabular Data Generation
University of Massachusetts Dartmouth Dartmouth, MA USA · United States Military Academy West Point, NY USA
Adversarial Debiasing of Machine Learning Models for Enhanced Network Security against DDoS Attacks
Sep 28, 2026Aadith Sukumar, Isha Singh, Devershika Mohane +4Network Intrusion Detection Adversarial Debiasing
Symbiosis Institute of Technology Pune, India · Symbiosis Center for Applied Artificial Intelligence, Pune, India · Peoples’ Friendship University of Russia Moscow, Russian Federation

Aug 18, 2026J/K move · Enter open · S save

Cognitive Graph Intelligence for Adaptive and Robust DDoS Attack Detection in Next Generation Networks

Mohammad Arif Hossain, Yeahia Sarker, Md Jafrin Hossain, Most. Humayra Khanom Rime+1

Middle Tennessee State University, USA · C2C Tech, Germany · New Jersey Institute of Technology, USA

Network Intrusion Detection Generative Adversarial Networks Graph Neural Networks Class-Imbalanced Learning

Open paper AskPDF arXiv

Distributed Denial-of-Service (DDoS) attacks threaten network availability, requiring a cognitive detection process that senses traffic, infers intent, and supports an adaptive response under severe class imbalance and non-stationary conditions. This paper proposes a Graph-based Generative Adversarial Network (GraphGAN) that serves as the cognitive detection engine for this task. GraphGAN captures the relational structure among traffic flows while addressing imbalance through adversarial generation of synthetic samples. Sequential flows are converted into

k

-nearest neighbor graphs using sliding windows to preserve feature-similarity and temporal dependencies among flows. The generator learns the distribution of DDoS attacks to synthesize realistic minority samples, while a Graph Convolutional Network (GCN)-based discriminator distinguishes real from synthetic graph data. A separate GCN classifier, trained on the balanced dataset, performs the final detection decision. Evaluations on four benchmark datasets show that GraphGAN achieves superior accuracy, precision, and recall compared to state-of-the-art approaches, particularly in data-scarce scenarios. By integrating temporal graph construction, adversarial augmentation, and GCN classification, GraphGAN effectively models coordinated attack behaviors and mitigates class imbalance, providing a robust and topology-aware solution for intrusion detection in data-constrained environments.

Abstract

Network Intrusion Detection

Explore similar work

Cognitive Graph Intelligence for Adaptive and Robust DDoS Attack Detection in Next Generation Networks

Synthetic Network Packet Generation through Statistical Learning and Genetic Algorithms

Adversarial Debiasing of Machine Learning Models for Enhanced Network Security against DDoS Attacks