Malicious Host Detection by Imaging SYN Packets and A Neural Network

As is the case for recently networked systems, traffic analysis that detects malicious hosts is one of the most important issues in achieving better security. Many methods for detecting cyber attacks have been proposed; however, methods that specialize in detecting and identifying specific attacks will be obsolete in the near future. Instead of identifying types of cyber attacks, we propose a novel method to detect malicious hosts based on their behavior characteristics when they send SYN packets. Our method does not identify types of cyber attacks. It detects malicious hosts suspiciously sending SYN packets. This paper shows that (1) we have developed a method to convert a series of SYN packets to a visual image as input for neural networks, (2) the image represents distinctive features of the behavior of the hosts and (3) our convolutional neural network model successfully distinguishes malicious host from normal ones. Our preliminary evaluation using real-word traffic shows that the detection accuracy for identifying malicious hosts is over 98% regardless of types of attack.