A novel packet header visualization methodology for network anomaly detection

This paper presents novel methodology to visualize network traffic. In this paper, methods of transforming network packet header data to image are proposed. These methods can be used for real time anomaly detection and intrusion detection. Images can be processed in a number of ways to extract information from them. This formulation enables techniques from image processing to be applied to the analysis of packet header data to reveal interesting properties of traffic. Network anomaly detection systems can also take help from these processes. These methods can help to detect anomalies in an efficient manner and can be used as the basis of number of new anomaly detection methods. Analysis and comparison of generated images is also presented. Images of network traces are generated using MIT Lincoln Laboratory 1999 DARPA Off-Line Intrusion Detection Evaluation dataset. Our focus here is to develop an innovative technique for network packet header visualization that will highlight the features of the network data most vulnerable to intrusions.