# Preliminary study on artificial intelligence methods for cybersecurity threat detection in computer networks based on raw data packets

arXiv: https://arxiv.org/abs/2407.17339 · HTML: https://mlsanity.com/paper/2407.17339/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 25 references that are in the map.
- First posted on arXiv 24 Jul 2024.

## Builds on (most cited first, 7 of 7)

- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [EfficientNet: Rethinking Model Scaling for Convolutional Neural Networks](https://mlsanity.com/paper/1905.11946/) (2019)
- [Rethinking the Inception Architecture for Computer Vision](https://mlsanity.com/paper/1512.00567/) (2015)
- [Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Maps](https://mlsanity.com/paper/1312.6034/) (2013)
- [Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction](https://mlsanity.com/paper/2401.12262/) (2024)
- [A Content-Based Deep Intrusion Detection System](https://mlsanity.com/paper/2001.05009/) (2020)
- [Vulnerabilities and Attacks Against Industrial Control Systems and Critical Infrastructures](https://mlsanity.com/paper/2109.03945/) (2021)

## Built on by (most cited first, 2 of 2)

- [A-THENA: Early Intrusion Detection for IoT with Time-Aware Hybrid Encoding and Network-Specific Augmentation](https://mlsanity.com/paper/2604.21623/) (2026)
- [Payload-Aware Intrusion Detection with CMAE and Large Language Models](https://mlsanity.com/paper/2503.20798/) (2025)

## Abstract (arXiv)

Most of the intrusion detection methods in computer networks are based on traffic flow characteristics. However, this approach may not fully exploit the potential of deep learning algorithms to directly extract features and patterns from raw packets. Moreover, it impedes real-time monitoring due to the necessity of waiting for the processing pipeline to complete and introduces dependencies on additional software components. In this paper, we investigate deep learning methodologies capable of detecting attacks in real-time directly from raw packet data within network traffic. We propose a novel approach where packets are stacked into windows and separately recognised, with a 2D image representation suitable for processing with computer vision models. Our investigation utilizes the CIC IDS-2017 dataset, which includes both benign traffic and prevalent real-world attacks, providing a comprehensive foundation for our research.