# An LSTM-Based Deep Learning Approach for Classifying Malicious Traffic at the Packet Level
## 3 Methodology
### Classification  
The classification mechanism is the next important part of the system. As illustrated in Figures 3-5, our packet-based traffic classification framework consists of three modules: packet pre-processing module, word embedding module, and LSTM module. However, to perform training in the LSTM module, we first need to label the benign/malicious mark for the packets in the dataset, e.g., ISCX2012 [17], USTC-TFC2016 [3] and Mirai-RGU [16]. Based on the label of the flows (well-labeled in ISCX2012 and USTC-TFC2016 dataset) and the packets (well-labeled in Mirai-RGU dataset), we mark the label of the corresponding packet (malicious/benign) according to the flow's label that the packet belongs to. For the LSTM module, we build standard LSTM cells, in which each cell consists of input gate, output gate, and forget gate. The sigmoid function is used as the activation function (\(\alpha\)). Our proposed framework, as shown in Figure 4, consists of three LSTM layers with dropout. Total parameters of the first layer (dimension = 128, without dropout) exceed 4 million (4,194,304). \begin{table}
\begin{tabular}{l l l} \hline \hline
**Header** & **Extended Fields** & **Details** \\ \hline Ether header (3) & extended to 7 fields & ether.dst(2 \(\times\) 3), ether.src(2 \(\times\) 3), ether.type \\ \hline IP header (12) & extended to 14 fields & ip.version, ip.ihl, ip.to, ip.len, ip.id, ip.flags, \\  & & ip.frag, ip.ttl, ip.proto, ip.chksum, ip.src(2 \(\times\) 2), ip.dst(2 \(\times\) 2) \\ \hline TCP header (10) & extended to 12 fields & tcp.sport, tcp.dport, tcp.seq(2 \(\times\) 2), tcp.ack(2 \(\times\) 2), tcp.dataofs, \\  & & tcp.reserved, tcp.flags, tcp.window, tcp.chksum, tcp.ugptr \\ \hline UDP header (4) & extended to 12 fields & ud.sport, udp.dpot, udp.len, udp.chksum, 0, 0, 0, \\  & & 0, 0, 0, 0, 0, 0 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Packet header(tcp:25, udp: 19) fields, extended fields (tcp: 33, udp: 33) and the length of the fields. Figure 2: The illustration of the packet-word-transfer mechanism. The pseudo-code of our algorithm and the processing flow is illustrated in Algorithm 1. The preprocessing phase adjusts features to ensure data representation is suitable for the used algorithms, i.e., parsing the packet and converting it to the translated word. The new dataset of translated Words is in the format of the dataset of integer number. The translated dataset is then split  
Figure 4: The illustration of the full network model. Figure 5: The illustration of the workflow of the training and testing/validation stage. Data pre-processing and packet labelling for training are done at the training stage. Training/Testing is done at the pre-processing data and with the ratio is 9:1. Validation is performed on the random samples (60 s/pcap). Figure 3: The illustration of the packet-word-transfer and classification module in the proposal. Packet-work-transfer module is at the input data layer. into two parts: Training Data and Testing Data, respectively. Training stage starts on the Training Data and running the LSTM three-layer model. Note that the dimension from input data are required to reshape, e.g., 64, before performing the training and testing. The dropout rate is flexibly set and can be tuned up to 0.5. The loss function is based on binary cross entropy and RMSProp optimizer is selected for the learning rate adjustment method. A dense output layer with softmax is added to the model. The model is then compiled with the binary cross-entropy as the loss function and the Adam optimiser over total of 200 iterations. Finally, the model is testing on the Testing Data to determine the effectiveness of the model in terms of accuracy, precision, recall, f1-score, and loss (defined later in the next section).