## 3 Raw Network Traffic Analysis
### Proposed Model  
Our model consists of a single 2D-CNN layer of 32 filters with a kernel size of 3 and ReLU activation [16]. (Any negative values output by a neuron in the layer are adjusted to zero, and any positive values are simply output unchanged by the ReLU activation.) The configuration of the CNN layer means that 32 windows of 3 \(\times\) 3 pixels shift across each bitmap to process it. The output of these filters on each section of the bitmap are then flattened into a single array suitable for input into a small densely-connected layer of 128 nodes, also with ReLU activation [16], in order to perform some analysis on the processed data from the CNN layer. This layer is then connected to a final densely-connected layer of 5 nodes; these predict the specific categories the model is meant to identify. The first two predict benign and malicious samples, respectively, while the remaining three consolidate any data which is not useful for the benign/malicious differentiation. The hyperparameters of this model are summarized in Table 1.  
The model works with bitmap images created from one or more packets per flow. The preprocessing complexity increases rapidly as more packets in a flow are used to create bitmaps. A table must be kept containing the first packet of each flow awaiting its second packet, methods of correlating each first packet to its second packet must be developed, protocols for dealing with a filled table must be defined, and a slew of security issues such as buffer overflows and denial of service attacks on this table need to be addressed. So any increase in detection accuracy must be balanced against the increase in the preprocessing complexity. In this paper, we consider two cases: images formed using the first packet of a flow and images formed using the first two packets of a flow.  
By taking a limited number of packets from the beginning of a flow, the actual flow size and duration is irrelevant to detection speed or processing overhead. This type of  
\begin{table}
\begin{tabular}{c c} \hline \hline \multicolumn{2}{c}{**2D-CNN Model Details**} \\ \hline
**Layer** & **Hyperparameters** \\ \hline Conv2D & 32 filters, kernel size 3, ReLU \\ Flatten & N/A \\ Dense & 128 nodes, ReLU \\ Dense & 5 nodes \\ \hline \hline \end{tabular}
\end{table}
Table 1: The hyperparameters of the 2D-CNN model. Any values not specified are left as the default settings for each layer.  
Figure 1: The full data pipeline for our analysis. The first half show preprocessing done on PCAP (network traffic) files to produce separate BMP (bitmap image) files for each flow. IP addresses in each bidirectional flow are randomized to create the effect of multiple attack sources. The IP datagrams from each flow are extracted and appended as-is to a predefined BMP file header. The second half shows the 2D-CNN model used for processing, including information about each layer. This information is also shown in Table 1. The packet data show the pipeline for a single packet; in two-packet analysis, the image would be twice the height, with the other half containing the second packet’s data.  
analysis could inherently produce results faster than any analysis based on an entire flow, especially in cases where large volumes of data are passed through a single flow.