Traffic Image Representation-Based ResNet-BiGRU Intrusion Detection

Intrusion detection has become a critical aspect of cybersecurity, requiring robust methods to identify and mitigate potential threats. Traditional intrusion detection techniques often rely on predefined features and rules, which may have limitations in detecting emerging and evolving threats. This paper proposes a new method for capturing raw traffic. Unlike traditional feature engineering methods, this method splits the data packets in raw traffic into flows based on a five-tuple, then divides the flows into multiple packets, extracting the first n bytes of data from the packets. The extracted data from multiple packets is then merged to extract the first 1600 bytes of data, which contains rich feature information from the flow. Secondly, after preprocessing the raw traffic data, the extracted byte data is converted into grayscale images using image processing techniques and input into the ResNet-BiGRU network model proposed in this paper. This model combines a ResNet-based CNN to extract spatial features from the grayscale images of the network flow and a BiGRU network to capture temporal features, ensuring a comprehensive analysis of the network traffic. Finally, experiments are conducted on the CICIDS2017 dataset, achieving an accuracy of 94.93%, compared to 92.81% using only ResNet-based CNN and 92.52% using only BiGRU. The ResNet-BiGRU model proposed in this paper demonstrates better classification performance compared to single network models.