Misata: Outcome-Conformant Synthetic Data Generation

Muhammed Rasin

Synthetic Data for Network Intrusion Detection

Describe the network and what you want to catch, for example 500 hosts over a week with 2% of flows being port scans and brute-force logins, and Misata Studio designs the tables, shows them to you for review, then builds hosts and labelled flows with the attack share you asked for, exact. For a benchmark where each attack carries its technique's real traffic signature, use the free netflow sample below.

Updated 2026-09-24.

You would write

A company network with 500 hosts and one week of netflow records, where 2% of flows are labelled attacks: port scans, brute-force logins and DNS exfiltration.

Studio designs the tables for your description and shows them to you before any data is made, so you can change them first.

Start from this

What Studio typically designs

hostsInternal and external machines

flowsTimestamped connections with ports, protocol, bytes and an attack label

What holds, and how you know

These are checked on the finished data, not assumed. Each dataset comes with a certificate listing what you asked for and whether it was met. How we verify.

The attack share you state is exact, and every flow points at real hosts
Timestamps stay inside the window you give
Every foreign key points at a row that exists, checked on the finished data
Every count, total, rate, share and date window you state is applied exactly, or listed as not applied
A certificate lists each requirement and whether the data meets it

Free sample dataset

500 hosts and 20,000 flows where port scans, DDoS, DNS exfiltration and brute force each carry the packet, byte and port signature of their MITRE ATT&CK technique. That signature modelling is in the sample, not a built-in Studio model.

See the sample

Have a schema, specialised rules or a large volume and would rather hand it off? Ask us to build it for you.

Frequently asked

Do I need real network data to generate this?

No. Misata Studio builds the dataset from a description, a schema you draw, or a structure you import (SQL DDL, DBML or a CSV header). No real records are uploaded, copied or learned from, so there is nothing to anonymise.

Is the generated network data privacy safe?

Yes. Nothing is learned from real records, so no real person, customer or account can appear in the output. A model writes names, places and wording, and Studio may research public facts on the web (you can turn research off). It never asks for your data.

Can I control the numbers, like rates and totals?

Yes. State a total, a monthly curve, a share or a rate in plain words, or draw the curve, and Studio applies it exactly. The certificate lists each figure and whether it was met. If a figure cannot be met, Studio says so instead of changing it.

Can I use my own schema?

Yes. Paste SQL DDL or DBML, import a CSV structure, or draw the tables on the canvas. A schema you give is followed exactly, and any difference is reported.

Which formats can I export?

CSV, Excel, Parquet, JSON Lines, SQL for Postgres, MySQL, SQL Server, Oracle, BigQuery and Snowflake, SQLite, DuckDB, dbt seeds, Prisma, DBML, TypeScript, JSON Schema, a data dictionary and more.

Does Studio have a ready-made network intrusion model?

Not a fixed one. Studio designs the tables for your network intrusion description, shows them to you for review before any data is made, and then builds and checks the data. What it guarantees for every run holds here too: matching keys, exact stated numbers, ordered dates and a certificate. Domain formulas you need beyond that should be stated in the description, and the certificate shows whether each was met.

Choosing a tool? How Misata compares

Misata vs Seedfast Misata vs Faker Misata vs SDV Gretel alternative: Misata Studio Misata vs Mockaroo Misata Studio vs Tonic Fabricate Misata as a Neosync Alternative MOSTLY AI alternative: Misata Studio Misata as a dbldatagen Alternative Misata as a Tonic Alternative Misata vs Syntho