Image-based Neural Network Models for Malware Traffic Classification using PCAP to Picture Conversion

Agrafiotis, Georgios; Makri, Eftychia; Flionis, Ioannis; Lalas, Antonios; Votis, Konstantinos; Tzovaras, Dimitrios

doi:10.1145/3538969.3544473

Cited by 10 publications

(5 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As reported in Table 4, the best performing model is the customized-CNN for all the values of N . Notably, this model slightly outperforms also the models proposed in [24] and [25] by 0,00878 and 0,01229, respectively. When increasing N , the F1-score of the model improves.…”

Section: Resultsmentioning

confidence: 79%

“…Results for the different considered N values are reported in Table 4. In the results, we included the performance (in terms of F1-score) of the considered architectures, i.e., both state-of-the-art computer vision architectures and the customized-CNN, and we compare the obtained values with the best performing model for both binary and multi-class experiments of Multi Layer Perceptron (MLP), obtained by [24] and the technique introduced in [25].…”

Section: Resultsmentioning

confidence: 99%

“…Tailored to specific 5G datasets, both works in [24], [25], deal with traffic classification. The first works on features extracted from complete traffic flows, hampering its exploitation on 5G/6G scenarios.…”

Section: Related Workmentioning

confidence: 99%

“…Embeddings & FC [25] (binary) 0.9989 Embeddings & FC [25] (multi-class) 0.98666 RF Sehan [24] (binary) 0.9989 RF Sehan [24] (multi-class) 0.99017 MAGNETO [48] (binary) 0.9913 MAGNETO [48] malicious behaviors. We have firstly discussed how raw packets can be converted in a real-time manner to input Results have shown that complex models do not perform better than the developed CNN architecture.…”

Section: Model F1-scorementioning

confidence: 99%

See 3 more Smart Citations

Real-Time Network Packet Classification Exploiting Computer Vision Architectures

Paolini,

Valcarenghi,

Maggiani

et al. 2024

IEEE Open J. Commun. Soc.

View full text Add to dashboard Cite

This research is partly supported by the project CLEVER (project number 101097560). The project is supported by the Key Digital Technologies Joint Undertaking and its members (including top-up funding by the Italian Ministry of Research and University (MUR)). This work is also partially supported by the European Union under the Italian National Recovery and Resilience Plan (NRRP) of NextGenerationEU, partnership on "Telecommunications of the Future" (PE00000001 -program "RESTART"), and by the project SmartComputing and Communication at the Edge (SMARTCOM) funded by Sma-RTy and CNR.

show abstract

Section: Resultsmentioning

confidence: 79%

Section: Resultsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Model F1-scorementioning

confidence: 99%

See 2 more Smart Citations

Real-Time Network Packet Classification Exploiting Computer Vision Architectures

Paolini,

Valcarenghi,

Maggiani

et al. 2024

IEEE Open J. Commun. Soc.

View full text Add to dashboard Cite

show abstract

“…Agrafiotis et al [2] generated 28x28 grayscale images almost identically to Wang's paper [1]. However, they applied to a different dataset called CIC-IDS2017 [18].…”

Section: Related Workmentioning

confidence: 99%

Classifying Malware Traffic Using Images and Deep Convolutional Neural Network

Davis,

Xu,

Roy

2024

IEEE Access

View full text Add to dashboard Cite

Network traffic classification plays a crucial role in detecting malware threats. However, most existing research focuses on extracting statistical features from the network traffic, ignoring the rich information contained within raw packet capture (pcap) files. To achieve higher accuracy in malware traffic classification, we propose a novel approach that fully utilizes the information contained in the pcap files by representing them with images and then train deep Convolutional Neural Networks (CNN) to learn the features automatically and classify them with higher accuracy. We transform selected fields of the IP headers in network sessions into 50x50 RGB images. These images serve as input to CNN, and malware samples are grouped by class or malware name. The model is initially trained and validated on the MCFP dataset with more than 140 malware classes and subsequently tested on separate datasets, namely USTC-TFC2016, Taltech.ee MedBIoT, and IEEE-Mirai. The macro F1 scores and accuracy of our method are significantly higher than the baseline statistical-feature based approach both in the validation dataset and in the test datasets from different sources. The result of this research has potential to be extended beyond malware classification to enable the classification of various types network traffic data.

show abstract

NetTiSA: Extended IP flow with time-series features for universal bandwidth-constrained high-speed network traffic classification

Koumar,

Hynek,

Pešek

et al. 2024

Computer Networks

View full text Add to dashboard Cite

Image-based Neural Network Models for Malware Traffic Classification using PCAP to Picture Conversion

Cited by 10 publications

References 10 publications

Real-Time Network Packet Classification Exploiting Computer Vision Architectures

Real-Time Network Packet Classification Exploiting Computer Vision Architectures

Classifying Malware Traffic Using Images and Deep Convolutional Neural Network

NetTiSA: Extended IP flow with time-series features for universal bandwidth-constrained high-speed network traffic classification

Contact Info

Product

Resources

About