Work

Raw binary data usage with deep learning for advanced persistent threat attacks early stage detection

Year: 2026

Type: article

Abstract: This paper presents a method for detecting anomalies directly from binary data using Deep Learning techniques. We aimed to support information security in network environments. The approach employs Deep Learning models based on neural networks to analyze raw binary data without preprocessing or transformation, allowing the detection of low-level deviations in the data patterns. The model’s performance with raw binary data was evaluated using three publicly available datasets: CIC-IDS2017, CIC-IDS2018, and IoT-IDS. Evaluation results indicated that the method can detect various types of attacks, with consistent performance on all tested datasets: the F1-scores were .9674 (CIC-IDS2017), .9911 (CIC-IDS2018), and .9957 (IoT-IDS). The paper outlines the method’s design and includes the model architecture, evaluation procedures, and observed performance metrics for anomaly detection tasks. The detection results are also presented and analyzed in detail.

Source: International Journal of Machine Learning and Cybernetics

DOI: 10.1007/s13042-025-02853-0

Authors: Tero Bodström, Timo Hämäläinen

Institution: University of Jyväskylä

Language: English

Topic: Network Security and Intrusion Detection

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

Open Access status: hybrid

Estimated APC paid: $3,990

Funder: Jyväskylän Yliopisto