A Novel Byte-Level Flow-to-Image Encoding Method for Network Intrusion Detection Systems

Technical Summary: A Novel Byte-Level Flow-to-Image Encoding Method for Network Intrusion Detection Systems

Problem Statement
Network-based Intrusion Detection Systems (IDS) are predominantly trained on tabular flow records. These one-dimensional (1D) representations limit the capacity of convolutional architectures to exploit inter-feature spatial correlations, as standard models treat features independently or through sequential operations. While existing methods have attempted to convert network traffic into two-dimensional (2D) image representations to leverage Convolutional Neural Networks (CNNs), they often rely on dimensionality reduction or heuristic spatial arrangements. These approaches frequently discard fine-grained numerical information through normalization or arbitrary feature placement, potentially compromising the reliability of intrusion detection.

Methodology
The authors propose a deterministic and reversible byte-level flow-to-image encoding method that converts each network-flow record into a fixed-size 32×32 RGB image without loss of numerical precision. The encoding process involves three primary stages:

1. Feature Partition and Preparation: Features are divided into continuous and categorical types. Continuous features are standardized using z-score normalization (mean and standard deviation derived exclusively from the training split). Categorical features are mapped to integer indices rather than one-hot encoding to avoid high-dimensional sparsity.
2. Byte Encoding: Continuous features are cast to float32 (IEEE-754 single-precision format) and serialized into four bytes. Categorical features are encoded as 1-byte values (promoted to 2 bytes if the vocabulary exceeds 255).
3. Spatial Layout:
   • Continuous Features: Serialized bytes are packed sequentially into pixels along an "inverted-L" shaped trajectory, starting from the bottom-right corner $(S-1, S-1)$, moving upward to $(0, S-1)$, and then leftward to $(0, 0)$. Crucially, because a pixel holds 3 bytes (RGB) and a feature holds 4 bytes, feature boundaries are intentionally misaligned with pixel boundaries. This forces convolutional filters to aggregate information across both channel and spatial dimensions to capture intra-feature byte patterns and inter-feature correlations.
   • Discrete Features: Categorical indices are placed contiguously in the center of the middle row $(\lfloor S/2 \rfloor)$, providing a fixed spatial anchor that separates discrete patterns from continuous byte patterns.
   • Padding: Unused positions are zero-padded (black background).

The study evaluates this encoding against four IDS models (CNN, CNN-LSTM, CNN-BiLSTM, and ResNeXt-50) using both 1D flow and 2D image configurations on the NSL-KDD and UNSW-NB15 datasets, utilizing their original training and testing splits to ensure reproducibility.

Key Contributions

• Novel Encoding Scheme: A deterministic, reversible method that converts tabular flow records into 32×32 RGB images while preserving original feature values and numerical precision.
• Architectural Agnosticism: The method requires no modification to existing model architectures, allowing direct comparison between 1D and 2D modalities.
• Empirical Validation: Comprehensive evaluation on two benchmark datasets demonstrates that the image-based representation consistently improves detection accuracy across both shallow and deep architectures.

Experimental Results
The image-based representation yielded consistent accuracy gains over flow-based baselines:

• UNSW-NB15: The method achieved accuracy improvements of up to 15.6% for binary classification and 12.8% for multi-classification. Notably, it significantly alleviated the performance disparity between normal and attack classes, raising attack class accuracy from a low of ~29% (in 1D models) to over 96% in image-based models.
• NSL-KDD: Improvements were more modest but consistent, with gains of up to 3.5% for binary classification and 3.2% for multi-classification. The most significant improvements were observed in minority class detection (e.g., R2L and U2R), where accuracy for specific classes increased by over 30 percentage points in some configurations.
• Stability: Image-based models exhibited smaller standard deviations across repeated experiments, suggesting improved training stability compared to flow-based counterparts.

Significance and Claims
The paper claims that byte-level visual encoding strengthens AI-driven intrusion detection in local computer networks by enabling convolutional filters to learn consistent local patterns and inter-feature relationships that are inaccessible through sequential 1D processing. The authors emphasize that this approach is particularly effective for detecting rare attack types where 1D representations lack sufficient discriminative information.

The authors acknowledge limitations, noting that the method's effectiveness is partially dependent on feature composition (datasets with more binary/nominal features result in more zero-padded regions) and that the current fixed layout does not explicitly account for semantic inter-feature correlations. Furthermore, the evaluation is restricted to offline benchmark datasets, and real-time performance in streaming traffic conditions remains to be validated. Future work is proposed to explore adaptive spatial layouts based on feature correlation and to investigate deployment in resource-constrained environments.