Research Article
Boosting GAN Performance: Feature Transformation for Heavy-Tailed Malware Data Generation
@INPROCEEDINGS{10.1007/978-3-031-94445-1_14, author={Ghebrebrhan Gebrehans and Willian T. Lunardi and Ernesto Damiani}, title={Boosting GAN Performance: Feature Transformation for Heavy-Tailed Malware Data Generation}, proceedings={Security and Privacy in Communication Networks. 20th EAI International Conference, SecureComm 2024, Dubai, United Arab Emirates, October 28--30, 2024, Proceedings, Part I}, proceedings_a={SECURECOMM}, year={2026}, month={9}, keywords={Generative Adversarial Networks (GANs) Cybersecurity Heavy-tailed data Feature Transformation Malware behavior Generation}, doi={10.1007/978-3-031-94445-1_14} }- Ghebrebrhan Gebrehans
Willian T. Lunardi
Ernesto Damiani
Year: 2026
Boosting GAN Performance: Feature Transformation for Heavy-Tailed Malware Data Generation
SECURECOMM
Springer
DOI: 10.1007/978-3-031-94445-1_14
Abstract
GANs’ ability to learn data distributions and generate realistic samples makes them potentially useful in addressing data imbalance in malware detection systems. Still, a challenge has emerged to their adoption: traditional GANs work best when the input data follows a multi-normal distribution, while malware behavioral features often exhibit a heavy-tailed distribution. Recent literature recognizes that only GANs specifically designed to generate realistic malware behavior samples can successfully train ML-based malware detectors, and several GAN variants have been proposed - with mixed results - to overcome the limitations of traditional ones. In this work, we follow a different approach, introducing feature transformation techniques to Gaussianize the distribution of malware behavioral data. While some studies on financial and industrial process data have attempted to use similar feature transformations, we claim that this is the first time they are applied to data representing malware behavior. We focus on a standard Wasserstein distance-based GAN with gradient penalty (WGAN-GP), and train four variants of it, comparing their performance on raw and transformed malware behavioral data. The results consistently show that feature transformations can boost GANs’ performance as generators of training data. Classifiers trained on GAN-generated data that learned the distribution of inputs after feature transformation gain approximately 0.4% in the F1 score in both binary and multiclass classification scenarios.