## 3 Raw Network Traffic Analysis  
Our goal is to create a front-line network security model capable of being used in real-time malicious flow identification with as little computing resources as possible, ideally allowing it to be run on individual switches in the data plane of a Software-Defined Network (SDN). Such an analysis would be well suited to deployment at the perimeter of an organizational network, but could effectively be deployed anywhere. This would not only be a powerful network security tool in its own right, but by requiring less computational resources than similar methods, it would be available to more network operators, thereby enhancing security across the Internet as a whole.  
We are interested in ML/DL models that analyze meaningful raw bits (network and transport headers and their payloads) from network traffic and classify the flows as malicious or benign. The most commonly used ML models, such as RF, SVM, and \(k\)-NN [12, 13], require extraction of features based on several packets of flows or the entire flows. Many DL models such as RNN and LSTM [13] also require feature extraction or aggregation of data over time. To avoid high processing overhead, we do not perform any elaborate feature extraction. We also avoid collecting data over time as much as possible to allow rapid detection. Other DL models such as autoencoders [13] can be used on individual samples of raw data and are suited to anomaly detection, but are not suited to detecting specific anomalies (such as malicious traffic) without carefully tailoring the training data to select portions that clearly demonstrate the anomalies, which is difficult to do broadly with raw packet data.  
Neural networks such as Deep Neural Network (DNN) or 2D-CNN are designed to mimic neurological processes in biology, efficiently performing complex analysis of massive amounts of raw data. DNN would potentially be a valid model for our analysis as it can be used with either extracted features or raw data, but we seek to exploit advancements in image analysis techniques. Furthermore, prior research [14, 15] indicates that DNN and CNN have similar training and detection speeds as well as detection accuracy when using similarly sized models and the same input features. 1D-CNN is also capable of analyzing raw data, but as we described in Section 2, 2D-CNN may be preferable for a number of reasons. Therefore, we focus on image processing models and converting traffic flows into images for analysis by 2D-CNN models.  
To accomplish our goal, we seek to perform as little processing as possible on the data. Therefore, rather than spending time on each flow waiting for enough data from which to extract features and performing the necessary calculations for feature extraction, we simply analyze the raw packet data directly. We extract the raw bits of IP datagrams from the first packet or two of a network flow and append those extracted bits to a pre-made bitmap file header to create a bitmap of the flow. We then use a simple 2D-CNN-based computer vision model to analyze the resulting bitmaps and classify them as either benign or malicious. The preprocessing steps and model are summarized in Figure 1.