## 6 Discussion
### Ustc16 Results Comparison  
A comparison of our proposed model with those of previous works which analyze the USTC16 dataset is shown in Table 5. Specifically, while our model demonstrates similar accuracy on the USTC16 dataset, it has lower complexity, less preprocessing, and is designed to be capable of live analysis. Additionally, since USTC16 proved to not be very challenging, the model has been tested on other publicly available datasets. These additional datasets also have a higher degree of attack diversity than those tested by some of the other prior works [3, 5]. The additional datasets we used (CIC17 and USTA21) featured a total of ten malicious categories, whereas the secondary datasets used by prior works only included two and eight categories, respectively.  
The works which analyze USTC16 either have a much more complex and thus slower model [5], involve more in-depth preprocessing [1, 3, 4, 5], or are inherently incapable of live detection prior to the end of a flow [1].  
In [5], the model in question contains both a 1D-CNN layer with 32 filters of size 6 and another with 64 filters of size 6. This means that, despite using 1D-CNN, the CNN layers of their model are still approximately twice as large as the single CNN layer in ours. Their model also features seven consecutive densely-connected layers with a total of 3363 nodes within them, meaning over 800,000 connections between the dense layers, whereas our two small dense layers have only 640 connections between them.  
In [1, 3, 4, 5], extensive preprocessing is used to analyze the USTC16 dataset, involving multiple conversions and filters on the data such as changing the raw packet data into different number and vector formats, or performing several file conversion operations. Our model does not perform any such conversions, directly reading the raw packet data as pixel data instead.  
In [1], the model presented can only achieve high accuracy when using entire pcap files containing all packets in completed flows as input to the model. Because our model only requires the first two packets of a flow, ours is able to begin analysis much faster.  
Previous research [3] indicates that accuracy would improve when adding a second packet to analysis, but most of our USTC16 results do not reflect this. This may be because the prior research used different models for one- and two-packet analysis, whereas our model architecture is the same between the two cases. Furthermore, whenever the model does not achieve near-100% accuracy with one packet, two-packet analysis does improve detection accuracy. This can also be seen in the additional results in Table 4.  
\begin{table}
\begin{tabular}{l l l l l l l} \hline \hline
**Paper** & **Models Used** & **Packets per Flow** & **Packet Types and Formats** & **Model Complexity** & **Live** & **Datasets Analyzed** \\ \hline This Paper & 2D-CNN & First 2 & Raw IP & 4 & Yes & CIC17 [18], \\  & & & & & & USTC16 [1], \\  & & & & & & USTA21 [19] \\ \hline [PERSON] et al. [1] & 2D-CNN & All & Entire pcap files & 7 & No & USTC16 [1] \\ \hline [PERSON] et al. [3] & 1D-CNN & First 2 & Raw packets in pcap files & 5 & Yes & USTC16 [1], \\  & & & & & & CTU [10] \\ \hline [PERSON] et al. [4] & 1D-CNN & First 1 & Raw packets in pcap files & 14 & Yes & USTC16 [1] \\ \hline [PERSON] et al. [5] & 1D-CNN + Auto-encoder & First 2 & Raw packets in pcap files & 11 & Yes & USTC16 [1], \\  & & & & & & Mirai-RGU [11] \\ \hline \hline \end{tabular}
\end{table}
Table 5: A comparison of our proposed model with related works using the USTC16 dataset. All works presented achieve approximately 100% balanced accuracy when analyzing this dataset alone. Model Complexity is reported as a measure of number of layers. The Live column indicates whether the proposed solution’s design allows for live analysis prior to the end of a flow.