D 2 PI : Identifying Malware through Deep Packet Inspection with Deep Learning

Malicious contents’ main means of distribution are through the Internet. Common and effective security measures that detect and can signal the prevention of malicious content propagation are Network Intrusion Detection Systems (NIDS) such as Snort. In this paper, we propose D 2 PI, a novel way of identifying network traffic with malware by performing deep packet inspection with a Convolutional Neural Network. D 2 PI is a neural network architecture that uses character embeddings followed by deep convolutional networks trained upon the payloads of packets from the dataset and functions as an NIDS. In an evaluation that uses a dataset of 127 distinct malwares and a sampling of over 16GB of benign traffic, our D 2 PI outperforms the popular open source intrusion detection system Snort by more than 17% in F1 score. Furthermore, D 2 PI should lend itself well to integration with other NIDS techniques or systems to further improve accuracy and might be more effective at identifying zero-day attacks than current state of the art commercial NIDS. Introduction Network traffic classification is an important task in modern communication networks due to the rapid growth of high throughput, traffic demands, and the security concerns that arises with network traffic. Attackers take advantage of this growing Internet connectivity to access computers over the network to do things like encrypt important data (ransomware), install backdoors (trojan horses), and send selfpropagating programs that infect more machines (worms). Static analysis of malware in machines often occurs too late; the malware has had time to execute arbitrary code already [1]. An area of security research that arose to detect such attacks in real time by analyzing the traffic itself is called network intrusion detection (NID). A network intrusion detection system (NIDS) is composed of software and/or hardware designed to detect unwanted attempts to access, manipulate, and/or disable computer systems. An NIDS is used to detect several types of malicious behaviors that can compromise the security and trust of a computer’s system. These threats are various, and include network attacks against vulnerable services, data driven attacks on applications, and host based attacks such as privilege escalation, unauthorized accesses, and malware (viruses, worms) [2][3]. These detection systems can be categorized into two methods: (1) Auditing packet information and signatures available to classify traffic, and (2) Observing traffic directly using packet filters or other detection schemes. These detection systems are usually equipped with static analyzers and feature extractors that leverage things like deep packet inspection, which examines packet payloads [4][5]. They use malware scanners that dynamically use run-time information in memory to identify behavior that appears malicious or statically extract features from disk of files that may be malware [6]. However, these approaches defend best when malware signatures are explicitly known, so they are generally ineffective against zero-day attacks and amorphous malwares. They also require great investments of security expert time to identify features that effectively classify the types of attacks that are known. It is not unusual for these systems to leverage hundreds of hand-selected features, and new ones often have to be defined to deal with emerging malware vectors. We propose a new approach of identifying malware by using a Convolutional Neural Network (CNN) that does