A Deep Intrusion Detection Model for Network Traffic Payload Analysis

Recently, many studies have focused on payload analysis. However, these studies mostly apply image-based deep classifiers for layer 7 traffic analysis and not specifically for intrusion detection. Furthermore, the proposed methods mostly focus on specific types of attacks. This paper introduces a Multi-deep classifier for Payload Intrusion Detection (McPID). The proposed architecture benefits from the generalization capability of deep algorithms in order to efficiently detect a wider range of payload-based attacks such as botnet communication, brute-force (SSH, FTPS, web-attack), and DoS. In order to evaluate the performance of the introduced architecture, three publicly available datasets such as CIC-IDS-2017, UNSW 2015, and CTU-2013 are applied in experimental results.