HAPMA: A Hybrid Adaptive Protocol Morphing Attack Framework for Robust Deep Learning Intrusion Detection

Network intrusion detection systems frequently suffer from severe class imbalance and limited representation of minority attack patterns, restricting deep learning models' ability to detect emerging web-based threats. This work proposes Hybrid Attack Pattern Morphing and Augmentation (HAPMA), a multi-mechanism feature-level synthetic augmentation framework designed to generate diverse, novel, and realistic web attack variants using the CIC-IDS2017 dataset. HAPMA integrates statistical blending, Gaussian Mixture Model (GMM) sampling, pairwise interpolation, adversarial micro-perturbations, and protocol-aware feature mutation to construct novel composite intrusion archetypes that capture hybridised, adaptive, and protocol-level attack characteristics. Deep learning models including Deep Neural Networks (DNN), Convolutional Neural Networks (CNN), and Long Short-Term Memory (LSTM) are trained on HAPMA-augmented data and compared against baseline models and Synthetic Minority Oversampling (SMOTE), augmentation techniques. Results show balanced gains, HAPMA-CNN doubles macro F1-score, improves Matthews Correlation Coefficient (MCC), while maintaining high overall accuracy (∼99%). Low Jensen Shannon Divergence confirms synthetic realism; cross validation on CIC IDS 2018 demonstrates generalization. Additional evaluation on UNSW-NB 15 benchmark, further support HAPMA, yielding constant gains in macro-F1 and balanced accuracy in native feature and harmonized feature settings. The HAPMA framework presents a systematic, layered, reproducible, and protocol-sensitive augmentation strategy, offering practical minority-class enhancement for existing IDS workflows rather than complete solutions.