# ByteStack-ID: Integrated Stacked Model Leveraging Payload Byte Frequency for Grayscale Image-based Network Intrusion Detection

arXiv: https://arxiv.org/abs/2310.09298 · HTML: https://mlsanity.com/paper/2310.09298/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 29 references that are in the map.
- First posted on arXiv 6 Oct 2023.

## Builds on (most cited first, 4 of 4)

- [Packet2Vec: Utilizing Word2Vec for Feature Extraction in Packet Data](https://mlsanity.com/paper/2004.14477/) (2020)
- [Cybersecurity Anomaly Detection in Adversarial Environments](https://mlsanity.com/paper/2105.06742/) (2021)
- [A Sequential Supervised Machine Learning Approach for Cyber Attack Detection in a Smart Grid System](https://mlsanity.com/paper/2108.00476/) (2021)
- [Detecting Unknown Attacks in IoT Environments: An Open Set Classifier for Enhanced Network Intrusion Detection](https://mlsanity.com/paper/2309.07461/) (2023)

## Built on by (most cited first, 1 of 1)

- [Adaptive Intrusion Detection for Evolving RPL IoT Attacks Using Incremental Learning](https://mlsanity.com/paper/2511.11464/) (2025)

## Abstract (arXiv)

In the ever-evolving realm of network security, the swift and accurate identification of diverse attack classes within network traffic is of paramount importance. This paper introduces "ByteStack-ID," a pioneering approach tailored for packet-level intrusion detection. At its core, ByteStack-ID leverages grayscale images generated from the frequency distributions of payload data, a groundbreaking technique that greatly enhances the model's ability to discern intricate data patterns. Notably, our approach is exclusively grounded in packet-level information, a departure from conventional Network Intrusion Detection Systems (NIDS) that predominantly rely on flow-based data. While building upon the fundamental concept of stacking methodology, ByteStack-ID diverges from traditional stacking approaches. It seamlessly integrates additional meta learner layers into the concatenated base learners, creating a highly optimized, unified model. Empirical results unequivocally confirm the outstanding effectiveness of the ByteStack-ID framework, consistently outperforming baseline models and state-of-the-art approaches across pivotal performance metrics, including precision, recall, and F1-score. Impressively, our proposed approach achieves an exceptional 81% macro F1-score in multiclass classification tasks. In a landscape marked by the continuous evolution of network threats, ByteStack-ID emerges as a robust and versatile security solution, relying solely on packet-level information extracted from network traffic data.