DETECTION OF COMPUTER ATTACKS USING 2D-CNN AND TRAFFIC SONIFICATION

Abstract

In modern computer networks, the ever-growing volume and diversity of traffic complicate the task of detecting attacks (IDS, Intrusion Detection System). Traditional approaches – signature-based, heuristic, and statistical – often fail to handle dynamic threats and result in numerous false positives. Although honeypots and machine learning and deep neural networks have demonstrated improved recognition accuracy, the question of effective data representation and the identification of complex patterns in high-dimensional spaces remains open. The purpose of the article is to substantiate and experimentally validate a «sonification» approach for network traffic in intrusion detection systems. The objective is to demonstrate that converting feature vectors into a pseudoaudio signal (PCM), followed by applying the Short-Time Fourier Transform (STFT), yields a two-dimensional (time × frequency) representation compatible with 2D convolutional neural networks (2D-CNN). This article compares the results with traditional 1D-based methods and examines the possibility of «enhancing» certain attributes through controlled adjustments of frequencies and amplitudes. The methodology involves employing classical audio-analytical techniques (PCM transformation, STFT) to form two-dimensional spectrograms, which are then used to train a 2D-CNN. For comparison with the traditional approach, the same NSL-KDD dataset is processed by a 1D-CNN. The evaluation criteria include accuracy, recall, and computational complexity. The scientific novelty lies in adapting audio-processing methods (specifically spectral analysis and 2D convolutions) to the IDS context. It is shown that «sonification» opens up new opportunities for visualization and further application of advanced audio/speech technologies in cybersecurity. Conclusions. Experiments indicate that the detection accuracy of attacks using sonification and 2D-CNN can be comparable to 1D approaches (~75–80 %), while offering improved interpretability and spectral visualization. However, the computational overhead grows accordingly, which suggests that future research might concentrate on speeding up the STFT procedure, balancing classes, and incorporating additional recurrent blocks (CRNN).