Raw binary data usage with deep learning for advanced persistent threat attacks early stage detection

Abstract This paper presents a method for detecting anomalies directly from binary data using Deep Learning techniques. We aimed to support information security in network environments. The approach employs Deep Learning models based on neural networks to analyze raw binary data without preprocessing or transformation, allowing the detection of low-level deviations in the data patterns. The model’s performance with raw binary data was evaluated using three publicly available datasets: CIC-IDS2017, CIC-IDS2018, and IoT-IDS. Evaluation results indicated that the method can detect various types of attacks, with consistent performance on all tested datasets: the F1-scores were .9674 (CIC-IDS2017), .9911 (CIC-IDS2018), and .9957 (IoT-IDS). The paper outlines the method’s design and includes the model architecture, evaluation procedures, and observed performance metrics for anomaly detection tasks. The detection results are also presented and analyzed in detail.