International Journal of Computer Theory and Engineering

Abstract

In recent years, the rise in cyber-attacks on the Internet has become a major concern. Addressing these threats requires continuous monitoring and analysis of communication patterns in cyberspace. However, the large volume and diverse nature of incoming packets and payloads present a challenge for simultaneous processing. Preliminary clustering of payloads is essential for subsequent analysis and interpretation. Previous studies have explored the use of natural language processing models such as N-gram, Word2Vec, and Bidirectional Encoder Representations from Transformers (BERT) to identify and categorize payloads, aiming to extract payload features for distinguishing between benign and malicious content. However, these models overlook the sequential order and byte-level positioning within payloads, thus limiting their effectiveness in capturing the intrinsic characteristics of payload content. This study introduces a novel model, which effectively extracts comprehensive features of payload content by considering the sequential ordering of byte sequences. Comparative experiments demonstrate that the clustering rate and clustering accuracy of the proposed method surpass those of other text feature extraction models such as N-gram, Word2Vec, and BERT, even when using the same clustering models. Moreover, the practical applicability of the proposed model is validated through its adaptation to actual observed data. This research significantly contributes to the field of cybersecurity and is expected to lead to future advancements and applications in this domain.