DeepBytes: Hierarchical Features Fusion with Deep Byte Feature for Malicious Traffic Detection

Malicious traffic detection is a critical means to detect network attacks, and plays an essential role in ensuring network security. However, most existing methods only focus on single feature or statistical feature, failing to comprehensively learn traffic information. Moreover, feature extraction remains superficial, resulting in a lack of important details. Thus, this paper proposes a novel malicious traffic detection method, named “DeepBytes”, which consists of original traffic vectorization, feature extraction and fusion, and classification. The original traffic vectorization converts the traffic into vectors. In the feature extraction and fusion phase, we first use the proposed CB-ResNet network to extract deep byte feature, then effectively fuse flow, packet, and byte-level features through the proposed multi-attention algorithm. The traffic classification identifies whether the traffic is malicious and determines its specific type. Extensive experimental results on the ISCXIDS2012 and CICIDS2017 datasets indicate that the detection performance and false alarm of our proposed method achieve 99.96% and 0.01 %, outperforming the state-of-the-art methods. The results also demonstrate that our method has excellent generalization capability and can accurately detect unknown attacks.