Intrusion Detection Using Payload Embeddings

Abstract

Attacks launched over the Internet often degrade or disrupt the quality of online services. Various Intrusion Detection Systems (IDSs), with or without prevention capabilities, have been proposed to defend networks or hosts against such attacks. While most of these IDSs extract features from the packet headers to detect any irregularities in the network traffic, some others use payloads alongside the headers. In this study, we propose a payload-based intrusion detection scheme, PayloadEmbeddings, using byte embeddings of the payloads of network packets. We employ a shallow neural network to generate vector representations for bytes and their corresponding payloads. Our feature extraction technique is coupled with the k-Nearest Neighbours (kNN) algorithm for the classification of packets as intrusive or non-intrusive.In our experiments, we evaluated 34 publicly available datasets, and used ten distinct payload-based, labeled intrusion detection datasets to train and evaluate our approach. Our empirical results show that PayloadEmbeddings reaches between 75% and 99% accuracy across all datasets. Finally, we compare our approach to other state-of-the-art and traditional intrusion detection techniques. Our findings suggest that PayloadEmbeddings demonstrates significant advantages over the other techniques on most of the datasets.

Network intrusion detection system by learning jointly from tabular and text‐based features

“…Intrusion detection using NLP techniques on payload features has been explored in prior research, including studies by Hassan et al (2021) and Vinayakumar et al (2019). In our study, we extend the work of Hassan et al in the intrusion detection domain, specifically leveraging payload features and NLP techniques.…”

“…Furthermore, it contributes to refining Snort rules and strengthening signature-based NIDS. Hassan et al (2021) proposed payload embeddings, a method that harnesses byte embeddings and a shallow neural network. Across various datasets, this approach consistently achieved accuracy rates ranging from 75% to 99%, outperforming traditional intrusion detection techniques.…”

Payload-Byte: A Tool for Extracting and Labeling Packet Capture Files of Modern Network Intrusion Detection Datasets

“…However, most network intrusion detection datasets only contain header information of network packets. Several datasets comprising real network traffic either do not have payload data or it has been removed due to privacy concerns [5]. The unavailability of labeled packet data is a significant issue in the packet-based NIDS.…”

“…Network Intrusion Detection System (NIDS) is often considered a feasible option to protect against network-based attacks [5], as it identifies attack behavior by analyzing the network traffic of vital nodes in a network. NIDS utilizes various approaches for the detection of malicious attack instances.…”

Intrusion detection model based on genetic algorithm optimization extreme learning machine of K-fold stratified cross-validation

“…With the rapid development of network and information technology, network security is directly related to national security and social stability [1] . Based on the urgent need of network security and the disadvantages of existing intrusion detection systems, the development and innovation of intrusion detection technology is imperative [2][3] .…”