Classifying Malware Traffic Using Images and Deep Convolutional Neural Network

Abstract

Network traffic classification plays a crucial role in detecting malware threats. However, most existing research focuses on extracting statistical features from the network traffic, ignoring the rich information contained within raw packet capture (pcap) files. To achieve higher accuracy in malware traffic classification, we propose a novel approach that fully utilizes the information contained in the pcap files by representing them with images and then train deep Convolutional Neural Networks (CNN) to learn the features automatically and classify them with higher accuracy. We transform selected fields of the IP headers in network sessions into 50x50 RGB images. These images serve as input to CNN, and malware samples are grouped by class or malware name. The model is initially trained and validated on the MCFP dataset with more than 140 malware classes and subsequently tested on separate datasets, namely USTC-TFC2016, Taltech.ee MedBIoT, and IEEE-Mirai. The macro F1 scores and accuracy of our method are significantly higher than the baseline statistical-feature based approach both in the validation dataset and in the test datasets from different sources. The result of this research has potential to be extended beyond malware classification to enable the classification of various types network traffic data.