Deep Sequence Models for Packet Stream Analysis and Early Decisions

Minji Kim, Dongeun Lee, Kookjin Lee, Doowon Kim, Sangman Lee, Jinoh Kim

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

The packet stream analysis is essential for the early identification of attack connections while in progress, enabling timely responses to protect system resources. However, there are several challenges for implementing effective analysis, including out-of-order packet sequences introduced due to network dynamics and class imbalance with a small fraction of attack connections available to characterize. To overcome these challenges, we present two deep sequence models: (i) a bidirectional recurrent structure designed for resilience to out-of-order packets, and (ii) a pre-training-enabled sequence-to-sequence structure designed for better dealing with unbalanced class distributions using self-supervised learning. We evaluate the presented models using a real network dataset created from month-long real traffic traces collected from backbone links with the associated intrusion log. The experimental results support the feasibility of the presented models with up to 94.8% in F1 score with the first five packets (k=5), outperforming baseline deep learning models.

Original languageEnglish (US)
Title of host publicationProceedings of the 47th IEEE Conference on Local Computer Networks, LCN 2022
EditorsSharief Oteafy, Eyuphan Bulut, Florian Tschorsch
PublisherIEEE Computer Society
Pages56-63
Number of pages8
ISBN (Electronic)9781665480017
DOIs
StatePublished - 2022
Event47th IEEE Conference on Local Computer Networks, LCN 2022 - Edmonton, Canada
Duration: Sep 26 2022Sep 29 2022

Publication series

NameProceedings - Conference on Local Computer Networks, LCN

Conference

Conference47th IEEE Conference on Local Computer Networks, LCN 2022
Country/TerritoryCanada
CityEdmonton
Period9/26/229/29/22

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Hardware and Architecture

Fingerprint

Dive into the research topics of 'Deep Sequence Models for Packet Stream Analysis and Early Decisions'. Together they form a unique fingerprint.

Cite this