## 2 Background  
Several researchers have used machine learning to analyze network traffic in ways similar to our proposed method. In this section we will review their techniques and identify how ours differs. First we will discuss researchers that have used similar data preprocessing techniques as ours to classify benign traffic data for network quality assurance. Then we will examine some malicious traffic detection techniques to use 1D-CNN to analyze streams of bytes from packets. Finally, we will discuss those who use 2D-CNN to analyze images generated from malicious packet data, whose techniques most closely resemble our own. [PERSON] et al. [7] produce images from 784 bytes of each IP datagram payload (transport layer segments) in the UNB ISCX VPN-nonVPN dataset [8] by treating each byte as an eight-bit integer grayscale pixel value. These images and their one-dimensional byte-stream counterparts are then used as input for an ensemble of parallel 2D-CNN, 1D-CNN, and RNN models. Weighted voting between these three models is used for the final classification of the traffic type. [PERSON] et al. [2] generate images by using four-bit segments of application layer packet data from the UPC dataset [9] as four-bit integer grayscale pixel values. A hybrid 2D-CNN+ResNet architecture is used to analyze these images and classify traffic based on application type. These attempts to classify normal network traffic have produced promising results and high degrees of accuracy, but they have not attempted to identify malicious traffic types. However, they could potentially be adapted to a network security task. This could be done by adjusting the input and output parameters to accommodate other categories of labels, and training these models using labeled datasets containing malicious traffic as well as benign. [PERSON] et al. [3] use two different 1D-CNN models to analyze raw packet traces. Their first model is a complex multi-layer model that takes as input 1024 bytes of the first packet of each flow in the USTC-TFC2016 dataset [1]. This is shown to perform poorly (77% accuracy) compared to their second model, a simpler model using only one convolution layer that takes as input the first 100 bytes of the first two packets per flow, which can achieve nearly 100% accuracy on both the USTC-TFC2016 and CTU [10] datasets. [PERSON] et al. [4] use the USTC-TFC2016 dataset [1] to analyze CPU usage of a 1D-CNN model while taking multiples of four bytes (between 54 and 784 bytes) from the first packet of each flow as input. They show that detection accuracy increases as more of a packet's header is included, but CPU usage also increases relative to the number of bytes taken per packet. In order to identify a suitable balance between accuracy and CPU usage, they propose an implementation of their own CPU analysis to detect CPU utilization in deployment and adjust the window size accordingly. [PERSON] et al. [5] examine the effects of using different numbers of bytes per packet and packets per flow as input for their 1D-CNN-based analysis on the USTC-TFC2016 [1] and Mirai-RGU [11] datasets using two 1D-CNN layers and seven densely-connected layers with between 10 and 1024 nodes in them. They take from each selected packet multiples of ten bytes, and a range from two to five packets per flow. They show that detection accuracy does not increase significantly by including more than two packets, and also show that including more of a packet's header improves accuracy. These 1D-CNN analysis methods are capable of achieving near-100% accuracy with the datasets used [1, 10, 11], but 2D-CNN is better suited to identifying initially unknown trends and relationships within the input data, depending on how the data are arranged within the image. Moreover, by necessitating input as images, it allows for a layer of abstraction from the original data. This may be a crucial first step towards opening an avenue for sharing packet-level attack data without compromising privacy. [PERSON] et al.