Intrusion detection using TCP/IP single packet header binary image for IoT networks

Abstract In today’s interconnected world, real-time intrusion detection poses a critical challenge due to the increasing volume, complexity, and diversity of IoT network traffic. Conventional methods often struggle to meet the stringent demands for low latency and high accuracy necessary to detect and mitigate cyber-attacks in dynamic environments like IoT networks. Exposure to the open and insecure Internet exacerbates these vulnerabilities, increasing the risks of privacy breaches and catastrophic consequences, including financial losses and threats to human safety. In response, we propose a novel approach to network intrusion detection that transforms single raw TCP/IP packet headers into binary images with maximal contrast between image components (black and white dots). It leverages the exceptional capabilities of Convolutional Neural Networks in computer vision to detect and classify network intrusions using single TCP/IP packet headers image. Experimental evaluation using the Edge-IIoTset and MQTTset datasets demonstrates outstanding performance. In binary classification, the lightweight CNN model, with only 35 trainable parameters, achieves 100% accuracy. For multiclass classification, accuracy rates reach 97.435% with Edge-IIoTset and 100% with MQTTset, with zero false positives for normal traffic across both datasets. These results highlight the proposed method's ability to enhance IoT security while accommodating the computational constraints of IoT devices. By bypassing complex feature extraction, the method significantly reduces latency, making it highly suitable for real-time applications.