DeepSec meets RawPower - Deep Learning for Detection of Network Attacks Using Raw Representations

Abstract

The application of machine learning models to the analysis of network traffic measurements has largely grown in recent years. In the networking domain, shallow models are usually applied, where a set of expert handcrafted features are needed to fix the data before training. There are two main problems associated with this approach: firstly, it requires expert domain knowledge to select the input features, and secondly, different sets of custom-made input features are generally needed according to the specific target (e.g., network security, anomaly detection, traffic classification). On the other hand, the power of machine learning models using deep architectures (i.e., deep learning) for networking has not been yet highly explored. In this paper we explore the power of deep learning models on the specific problem of detection of network attacks, using different representations for the input data. As a mayor advantage as compared to the state of the art, we consider raw measurements coming directly from the stream of monitored bytes as the input to the proposed models, and evaluate different raw-traffic feature representations, including packet and flow-level ones.