Network intrusion detection systems frequently suffer from severe class imbalance and limited representation of minority attack patterns, restricting deep learning models' ability to detect emerging web-based threats. This work proposes Hybrid Attack Pattern Morphing and Augmentation (HAPMA), a multi-mechanism feature-level synthetic augmentation framework designed to generate diverse, novel, and realistic web attack variants using the CIC-IDS2017 dataset. HAPMA integrates statistical blending, Gaussian Mixture Model (GMM) sampling, pairwise interpolation, adversarial micro-perturbations, and protocol-aware feature mutation to construct novel composite intrusion archetypes that capture hybridised, adaptive, and protocol-level attack characteristics. Deep learning models including Deep Neural Networks (DNN), Convolutional Neural Networks (CNN), and Long Short-Term Memory (LSTM) are trained on HAPMA-augmented data and compared against baseline models and Synthetic Minority Oversampling (SMOTE), augmentation techniques. Results show balanced gains, HAPMA-CNN doubles macro F1-score, improves Matthews Correlation Coefficient (MCC), while maintaining high overall accuracy (∼99%). Low Jensen Shannon Divergence confirms synthetic realism; cross validation on CIC IDS 2018 demonstrates generalization. Additional evaluation on UNSW-NB 15 benchmark, further support HAPMA, yielding constant gains in macro-F1 and balanced accuracy in native feature and harmonized feature settings. The HAPMA framework presents a systematic, layered, reproducible, and protocol-sensitive augmentation strategy, offering practical minority-class enhancement for existing IDS workflows rather than complete solutions.
Kohli et al. (Fri,) studied this question.