# Packet2Vec: Utilizing Word2Vec for Feature Extraction in Packet Data

arXiv: https://arxiv.org/abs/2004.14477 · HTML: https://mlsanity.com/paper/2004.14477/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Apr 2020.

## Built on by (most cited first, 7 of 7)

- [Knowledge Distillation-Empowered Digital Twin for Anomaly Detection](https://mlsanity.com/paper/2309.04616/) (2023)
- [XG-NID: Dual-Modality Network Intrusion Detection using a Heterogeneous Graph Neural Network and Large Language Model](https://mlsanity.com/paper/2408.16021/) (2024)
- [ByteStack-ID: Integrated Stacked Model Leveraging Payload Byte Frequency for Grayscale Image-based Network Intrusion Detection](https://mlsanity.com/paper/2310.09298/) (2023)
- [FastPacket: Towards Pre-trained Packets Embedding based on FastText for next-generation NIDS](https://mlsanity.com/paper/2209.14727/) (2022)
- [An experimental study in Real-time Facial Emotion Recognition on new 3RL dataset](https://mlsanity.com/paper/2304.03064/) (2023)
- [Vulnerability Detection Using Two-Stage Deep Learning Models](https://mlsanity.com/paper/2305.09673/) (2023)
- [CBR -- Boosting Adaptive Classification By Retrieval of Encrypted Network Traffic with Out-of-distribution](https://mlsanity.com/paper/2403.11206/) (2024)

## Abstract (arXiv)

One of deep learning's attractive benefits is the ability to automatically extract relevant features for a target problem from largely raw data, instead of utilizing human engineered and error prone handcrafted features. While deep learning has shown success in fields such as image classification and natural language processing, its application for feature extraction on raw network packet data for intrusion detection is largely unexplored. In this paper we modify a Word2Vec approach, used for text processing, and apply it to packet data for automatic feature extraction. We call this approach Packet2Vec. For the classification task of benign versus malicious traffic on a 2009 DARPA network data set, we obtain an area under the curve (AUC) of the receiver operating characteristic (ROC) between 0.988-0.996 and an AUC of the Precision/Recall curve between 0.604-0.667.