Network Intrusion Detection via Packet Image Conversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network intrusion detection systems (NIDS) using machine learning and deep learning algorithms face challenges in accurately detecting malicious activity due to their reliance on independent packet analysis, neglecting the sequential nature of network communication and crucial information from packet headers, which leads to biased models with high false negatives and positives, particularly in real-time detection and identifying header-level attacks.
Innovation Solution
A method and system that convert network packet data into pixel image attributes, processed using a trained neural network model to detect malicious activity, incorporating both header and payload data and preserving temporal-spatial associations between packets, enabling early and accurate detection of network attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If packet-based NIDS analyzes packets independently using ML/DL algorithms, then real-time detection capability is achieved, but detection accuracy deteriorates due to overlooking sequential nature of network communication
Solution Approach 1:
The patent transforms sequential packet data into 2D image representations, adding a spatial dimension to the temporal sequence of packets. This allows CNN-based models to simultaneously process both the sequential order and contextual relationships of packets in real-time, resolving the contradiction between speed and accuracy by enabling parallel processing of temporal and spatial features through the image-based representation.
2Productivity
If packet-based NIDS captures only payload data, then processing efficiency is improved, but ability to identify header-level attacks deteriorates
Solution Approach 1:
The patent merges payload data and header information into a unified image representation where different packet components are encoded as distinct visual features. This combination allows the model to process both payload and header information simultaneously without sacrificing efficiency, as the image-based approach enables parallel processing of all packet components while maintaining the ability to detect header-level attacks.
3Ease of manufacture
If traditional ML/DL models are trained using flow-based or packet-based features, then model training is simplified, but false negatives and positives increase due to biased models
Solution Approach 1:
The patent fundamentally changes the input parameter representation from traditional numerical packet features to visual image features. This parameter transformation enables the use of CNN architectures that are highly effective at pattern recognition, significantly reducing false negatives and positives while maintaining training feasibility through the availability of labeled network traffic data that can be converted to image formats.
Data Source
AI summary
The disclosed technology provides a method for detecting malicious activity in a network communication system. A first packet of a first flow is received from the network communication system. The first packet comprises a first sequence of data values. The first sequence of data values is converted to a first plurality of pixel image attribute values. A first portion of an image is generated based on the first plurality of pixel image attribute values. The image is processed using a trained neural network model to determine a likelihood of malicious activity in the first flow.