Transformation of Network Flow Data into Images for Intrusion Detection Using Convolutional Neural Networks

One of the most challenging problems in intrusion detection is the development of techniques that are able to detect novel and unseen attacks. Currently, the researchers are investigating applicability of the deep learning techniques to solve this task, as the deep learning models are known for their ability to reveal spatial as well as temporal patterns in data flows. However, their usage often requires converting tabular data to matrix-based structures. This paper presents an approach to constructing images from the raw sequence of bytes representing network flow, discusses several options to generate them, and evaluates their impact on the performance of intrusion detection model. The experiments are conducted using the CICIDS2017 dataset. The obtained results show that the proposed data preprocessing technique allows one to achieve high accuracy in attack detection, and as this approach does not require knowledge of protocol structure, it could serve as a basis for development of protocol-independent preprocessing techniques in intrusion detection tasks.