FastPacket: Towards Pre-trained Packets Embedding based on FastText for next-generation NIDS

TL;DR

FastPacket introduces a novel packet embedding method inspired by FastText, aiming to enhance next-generation NIDS by leveraging deep learning for dynamic feature extraction from raw network packets.

Contribution

The paper proposes a new character-level packet embedding approach called FastPacket, inspired by FastText, to improve attack detection in network intrusion detection systems.

Findings

Initial results on CIC-IDS-2017 dataset show promising detection improvements.

FastPacket demonstrates effective embedding of raw packets for security applications.

Proposed pre-trained model on MAWI dataset aims to advance packet-level NIDS.

Abstract

New Attacks are increasingly used by attackers everyday but many of them are not detected by Intrusion Detection Systems as most IDS ignore raw packet information and only care about some basic statistical information extracted from PCAP files. Using networking programs to extract fixed statistical features from packets is good, but may not enough to detect nowadays challenges. We think that it is time to utilize big data and deep learning for automatic dynamic feature extraction from packets. It is time to get inspired by deep learning pre-trained models in computer vision and natural language processing, so security deep learning solutions will have its pre-trained models on big datasets to be used in future researches. In this paper, we proposed a new approach for embedding packets based on character-level embeddings, inspired by FastText success on text data. We called this approach FastPacket. Results are measured on subsets of CIC-IDS-2017 dataset, but we expect promising results on big data pre-trained models. We suggest building pre-trained FastPacket on MAWI big dataset and make it available to community, similar to FastText. To be able to outperform currently used NIDS, to start a new era of packet-level NIDS that can better detect complex attacks.