Measuring the Impact of Synthetic Training Data on Cloud Intrusion Detection Under Class Imbalance

The threat landscape for cloud computing environments continues to evolve and grow more complex. Threats such as unauthorized access, distributed denial-of-service (DDoS) attacks, credential theft, malware activity, and moving laterally through virtualized infrastructure present significant challenges to the security of these systems. Intrusion detection systems (IDSs) provide one means of detecting and preventing these types of malicious actions. However, the performance of IDSs is often limited due to 'class imbalance'issues within the data sets used to train them. Class imbalance refers to situations in which the majority class (e.g., normal or benign network traffic) greatly outnumbers the minority class (e.g., intrusions). When machine learning models are trained with imbalanced data, they tend to predict the majority class and fail to recognize rare, yet highly damaging attacks. One way to address the issue of class imbalance is through the use of synthetic training data. Synthetic training data involves creating additional minority-class examples to assist machine learning models in learning more effectively from the data set. In this research, we investigate the effects of using synthetic training data on cloud intrusion detection under various levels of class imbalance. We have developed an experimental framework that allows us to compare conventional training, random oversampling, and synthetic sampling approaches. Our evaluation metrics include precision, recall, F1-score, area under the receiver operating characteristic curve (AUC-ROC), and area under the precision-recall curve (AUC-PR). Additionally, we evaluate the false-positive rates of each approach, the computational overhead involved in implementation, and the ability of detection models to generalize to previously unseen attack patterns. We place particular emphasis on preventing data leakage, accurately representing real-world traffic, and understanding the limitations of artificially generated attack samples. Rather than assuming that increasing synthetic data will automatically enhance security, we assess whether adding synthetic data results in quantifiable and practical improvements. Our proposed investigation offers a methodical approach to determining which data-balancing strategy best supports reliable, efficient, and robust intrusion detection in dynamic cloud environments.

Cloud Security, Intrusion Detection, Synthetic Training Data, Class Imbalance, Machine Learning, Anomaly Detection, Data Augmentation, Cybersecurity, Minority-Class Detection, Model Evaluation.