BI-TBL: A Network Intrusion Detection Method Based on Payload Analysis

Network-based intrusion detection system aims to distinguish between normal and malicious traffic and issue alerts when intrusions are detected to prevent malicious traffic from entering the system and causing damage. Currently, most intrusion detection methods are trained based on manually selected features, ignoring the critical role of payload in traffic for malicious traffic detection. In this paper, we propose an intrusion detection method based on payload analysis, which parses the payload in the traffic for training the intrusion detection system. To better extract serialized byte and packet information, a two-layer neural network consisting of a Transformer and Bidirectional Long Short-Term Memory Network (Bi-LSTM) is utilized to extract byte-level and packet-level features with contextual relevance. Experimental results on the CICIDS2017 dataset demonstrate the proposed method achieves better results in several metrics compared to other methods.