# An LSTM-Based Deep Learning Approach for Classifying Malicious Traffic at the Packet Level
## 3 Methodology  
### Dataset  
In deep learning, a lack of a variety of shareable traces dataset can be seen as one of the most obvious obstacles to obtain realistic progress on traffic classification. Many researchers may like creating synthetic datasets through their testbed. The shortcomings of this approach are that their generated traffic may not represent well the real traffic on the Internet, thus the performance evaluation results of the proposed solutions can face the problems of the credibility. Over the decades, the researchers have been recommended to use public famous traffic datasets such as KDD CUP1999 and NSL-KDD to test. Each dataset explicitly provides useful statistics on labeled features and the number of benign and malicious flows as well. However, these datasets do not provide information at the raw traffic level, which is required in our approach. In addition, while the credible dataset from Microsoft Malware Classification Challenge [15] can provide a metadata manifest and hexadecimal representation of the malware's binary content, the missing of packet information in the data, unfortunately, makes it hard to be used in this research.  
For the ones matching the requirements, USTC-TFC2016 [3] is one of the most prominent datasets. Table 2 summarizes the statistics of the benign and malware traffic in the dataset. As their statement, there are a total of ten types of malware traffic from public websites which were collected from a real network environment from 2011 to 2015. Along with such malicious traffic, the benign part contains ten types of normal traffic which were collected using IXIA BPS, a professional network traffic simulation equipment. The size of USTC-TFC2016 dataset is 3.71 GB, and the format is pcap.  
For the Mirai-based DDoS traffic, we use the dataset from Robert Gordon University [16], denoted by Mirai-RGU. This data set contains Mirai botnet traffic such as Scan, Infect, Control, Attack traffic and normal IoT IP Camera traffic. It contains ten types of malicious traffic, include HTTP flood, UDP flood, DNS flood, Mirai traffic, VSE flood, GREIP flood, GREETH flood, TCP ACK flood, TCP SYN flood, and UDPPLAIN flood. The dataset includes features such as Time, Source, Destination, Protocol,  
\begin{table}
\begin{tabular}{c c c c c} \hline  & **Benign** & \multicolumn{3}{c}{**Malware**} \\ \hline
**App Type** & **Size (MB)** & **Class** & **Malware Type** & **Size (MB)** \\ \hline Facetime & 2.4 & Voice/Video & Tinba & 2.55 \\ Skype & 4.22 & Chat/IM & Zeus & 13.4 \\ Bittorent & 7.33 & P2P & Shifu & 57.9 \\ Gmail & 9.05 & Email/Webmail & Neris & 90.1 \\ Outlook & 11.1 & Email/Webmail & Cridex & 94.7 \\ WorldOfWarcraft & 14.9 & Game & Nsisay & 281 \\ MySQL & 22.3 & Database & Geodo & 28.8 \\ FTP & 60.2 & Data transfer & Miuref & 16.3 \\ SMB & 1206 & Data transfer & Virut & 109 \\ Weibo & 1618 & Social Network & Htbot & 83.6 \\ \hline \end{tabular}
\end{table}
Table 2: Summary of benign and malware traffic in USTC-TFC2016 dataset. (Notations: SMB: Server Message Block; IM: Instant Message; P2P: Peer-to-Peer).  
Length, and overall payload information. In addition, we also collected a dataset from the Mirai botnet we have built in the campus of National Chung Cheng University(CCU) (denoted by Mirai-CCU), as shown in Figure 1, to generate four types of attack traffic with much bigger attack magnitude: TCP SYN (41 GB), TCP ACK (2.4 GB), HTTP POST (103 GB), UDP (127.06 GB) in the total of 667 GB attack data.  
To enrich the dataset for our experiments, we select ISCX2012 [17], which also contains both malicious and benign traffic. ISCX2012 consists of packets collected for seven days. Packets collected in the first and sixth day are normal traffic. In the second and third day, both normal packets and attack packets are collected. In the fourth, fifth, and seventh days, besides the normal traffic, HTTP DoS, DDoS and IRC Botnet, and Brute Force SSH packets are collected, respectively.