# An LSTM-Based Deep Learning Approach for Classifying Malicious Traffic at the Packet Level
## 2 Related Work  
Deep learning for malicious traffic detection has gained several notable achievements with various network models. For example, the authors in [2] proposed a novel network-based anomaly detection method which extracts behavior snapshots of the network and uses deep autoencoders to detect anomalous network traffic emanating from compromised IoT devices. The method is evaluated on commercial IoT devices infected by authentic botnets such as Mirai and BASHLITE. However, the performance of the work primarily relies on several self-generated synthetic data sets, which may lack the diversity of data exchange. In another research work [3], the authors proposed a malware traffic classification method using CNN by considering traffic data as images. The work is one of the first attempts to apply a representation learning approach for malware traffic classification from raw traffic. Unfortunately, the lack of detecting the unknown attacks and high detection time limits its prospect to deploy in practice. In addition, [PERSON] et al. [7] and [PERSON] et al. [6] proposed using an RNN model or a combination with Restricted Boltzmann Machines (RBM) for extracting micro-flow features based on a small set of packets and then directly training with the raw packets. However, they mostly target the detection accuracy and ignore the evaluation of the detection time. Thus far, there are several other state-of-the-art relevant studies such as [9; 10]. Generally, the key points of such work are that they all rely on the flow or session-based approach, i.e., indexing the traffic by the flow. Thus far, we have found no attempt to detect the attack traffic at the packet level. Our statistics on the relevant research and our research position are summarized in Table 1.  
Recently, word2 vector [13; 14] and LSTM-based learning models [10] provide a very powerful tool to give packet semantic meanings. This means we now can find a way to provide a thorough pattern for the malicious traffic by deep learning of a large number of raw packets. This particularly  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Research** & **Year** & **Method** & **Feature** & **Shortcomings** \\ \hline [PERSON] [11] & 2004 & Formulation & flow-based & For offline detection \\ [PERSON] [12] & 2016 & LSTM, GRU & flow-based & For offline detection \\ [PERSON] [9] & 2018 & LSTM & flow-based & For offline detection \\ [PERSON] [7] & 2018 & RNN, RBM & process packet, flow-based & For offline detection \\ [PERSON] [4] & 2018 & TSDNN, QDBP & flow-based, N class & For offline classification \\ [PERSON] [5] & 2017 & LSTM, GRU & process packet, flow-based & For offline detection \\ [PERSON] [10] & 2018 & WEDL-NIDS & process packet, flow-based & For offline detection \\
**Ours** & 2019 & LSTM, Word-embedding & raw data, packet-based & Target for online detection \\ \hline \hline \end{tabular}
\end{table}
Table 1: Summary of several state-of-the-art relevant research works and our research location. (Notations: GRU: Gated Recurrent Unit; TSDNN: Shaped Deep Neural Network; QDBP: Quantity Dependent Backpropagation; WEDL: Word Embedding-based Deep Learning; NIDS: Network Intrusion Detection System).  
helps to reinforce our approach to consider the malicious traffic classification at the packet level. Compared to the prior studies, there are two major differences in our work: (1) the system can identify the malicious traffic by classifying the individual packet, instead of checking the whole packets of a traffic flow; (2) our system can work directly with raw packets, i.e., reading and making detection decisions. To the best of our knowledge, our study is the first work on packet-based malicious traffic detection. In addition, despite the high detection accuracy achieved by prior work for the same attack types, a novel research direction on packet-based classification (i.e., ours) sheds a light toward research on online real-time deep learning based IDSs.