\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={Efficient Network Traffic Classification and Visualizing Abnormal Part via Hybrid Deep Learning Approach: Xception + Bidirectional GRU},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2021 2021-07-15 (revised: Year 2021 15 July 2021)}
\def\TheID{10.34257/GJCSTHVOL21IS3PG1\makeatother }
\def\TheDate{2021 2021-07-15}
\title{Efficient Network Traffic Classification and Visualizing Abnormal Part via Hybrid Deep Learning Approach: Xception + Bidirectional GRU}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{HanSeon  Joo}

             \author[2]{HaYoung  Choi}

             \author[3]{ChangHui  Yun}

             \author[4]{MinJong  Cheon}

\renewcommand\Authands{ and }

\date{\small \em Received: 6 June 2021 Accepted: 1 July 2021 Published: 15 July 2021}

\maketitle


\begin{abstract}
        


Due to a rapid development in the field of information and communication, the information technologies yielded novel changes in both individual and organizational operations. Therefore, the accessibility of information became easier and more convenient than before, and malicious approaches such as hacking or spying aimed at various information kept increasing. With the aim of preventing malicious approaches, both classification and detecting malicious traffic are vital. Therefore, our research utilized various deep learning and machine learning models for better classification. The given dataset consists of normal and malicious data and these data types are png files. In order to achieve precise classification, our experiment consists of three steps. Firstly, only vanilla CNN was used for the classification and the highest score was 86.2%. Second of all, for the hybrid approach, the machine learning classifiers were used instead of fully connected layers from the vanilla CNN and it yielded about 87% with the extra tree classifier. At last, the Xception model was combined with the bidirectional GRU and it attained a 95.6% accuracy score, which was the highest among all.

\end{abstract}


\keywords{}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\begin{textblock*}{10cm}(1.05cm,3cm)
{{\textit{CrossRef DOI of original article:}} \underline{10.34257/GJCSTHVOL21IS3PG1}}
\end{textblock*}\let\tabcellsep& 	 	 		 
\section[{Introduction a) Background}]{Introduction a) Background}\par
nformation and communication have experienced rapid growth in many ways over the past three generations. In particular, as the 3V (Volume, Velocity, and Variety) of information intensifies, users' freedom to access quality information also increases. Information technologies have brought new changes in both information usage between individuals and in business operations, such as introducing computerization to corporate marketing methods and sales management \hyperref[b10]{(Sanaei \& Sobhani, 2018)}. However, as the communication environment develops in this digital transformation process, malicious approaches such as hacking or spying aimed at user personal information, corporate confidentiality, and financial information become a problem \hyperref[b7]{(Layton, 2021)}.\par
Ransom DDos, which accounts for the largest number of DDoS attacks carried out in 2020, is also achieved through service paralysis attacks that drain the system's resources by creating huge amounts of packets, similar to conventional DDoS attacks, and bandwidth exhaustion attacks that exhaust TCP connections. In addition, numerous global hacking groups are openly attacking and threatening companies in the financial sector and manufacturing industries to compensate for money while hiding in the anonymity of virtual currency. Therefore, detecting large -scale broadband networks and analyzing harmful traffic in advance, along with intrusion detection systems operating on a specific network or set list, is an important technology that can block malicious attacks from the source \hyperref[b14]{(Williams, 2021)}. We call data which causes security problems with bad intentions 'malicious traffic'. Malicious traffic causes security problems for individuals, businesses or countries and damages the device. In order to detect malicious traffic, there must be a technology which can distinguish between normal traffic and malicious traffic \hyperref[b9]{(Rose, 2021)}. The graph below shows a share of global web application attack traffic as of April 2018, by originating country \hyperref[b12]{(Statista, 2021)}. Most existing studies classified malicious and normal traffic with csv type files. Therefore, there were limited ways to classify malicious and normal traffic. More AI models can be used by using image files, not just csv files. In order to use more AI models, this study classified malicious and normal traffic with image data, allowing various deep learning models such as CNN, Xception and BI-GRU to be applied. To optimize image files for deep learning models, we preprocessed the images and applied them to diverse AI models. First of all, we applied CNN based models and altered the optimizers such as adam, nadam, sgd, rmsprop in order to find the best optimizers. Secondly, we extracted the features from the image data through CNN and applied it to tree-based Machine learning models, such as Decision Tree Classifier, Random Forest Classifier and Extra Tree Classifier. Lastly, a hybrid deep learning based approach was used, which combines CNNbased Xception and RNN-based BI-GRU. 
\section[{c) Related Works}]{c) Related Works}\par
Mohiuddin Ahmed and Abdun Naser Mahmood developed a framework for collective anomaly detection using k-means model, to discover abnormal traffics that look legitimate but are in fact targeted to disrupt normal computing environments (in this paper, DoS attack). The experiment results are based on a widely accepted DARPA dataset for intrusion detection from MIT Lincoln Laboratory. Input data extracted from network traffic, <SrcIP, DstIP, Protocol, Payload Length> is used for clustering and the data showed high probability of being DoS attack. CAD's key idea is that a group of traffic flows collectively. The paper identified DoS and other similar attacks as collective anomaly based on x-means clustering, a variant of k-means algo and eight times faster than k-means. CAD's accuracy was compared against CBLOF, LDCOF and k-means algorithms, and the result was 97\%, 85\%, 93\% and 83\% respectively \hyperref[b0]{(Ahmed \& Mahmood, 2014)}.\par
Radford et al. demonstrated that network behaviors can be learned from traffic metadata using LSTM RNNs (which is able to detect patterns of traffic indicative of malicious computer system use without the assistance of labeled training data and visibility into each machine's internal state or processes) applied for anomaly detection. The research was motivated by cyber security (whose applications have been shifted from signature based matching methods to machine learning and statistical models) and NLP (communications between networked devices are captured in ordered sequence and the team expected its rule to be similar to grammar). They used a dataset that represents seven days of simulated network traffic with attack behaviors (such as infiltration, DoS, DDoS and SSH attack), from IDS tasks from the University of New Brunswick's Canadian Institute for Cyber security and ISCX. In methodology, each LSTM layer is composed of 50 hidden cells with linear activation, linear activation on the first layer and rectified linear activation on the second layer. Initial embedding layer projects input sequence from V unique tokens into a dense 100dimensional vector space. Entire dataset was trained with a ten-token sliding window, where each model was trained to predict the subsequent (eleventh) token. As a result, models based on proto-byte sequences produce higher AUC scores than any model based on service port sequence \hyperref[b8]{(Radford et al., 2018)}. R.Yuan, Z.Li and X.Guan proposed SVM-based ML model for internet traffic classification. The data has been obtained from a backbone router of the campus network of the author's university, 8-hour traffic data on a Gbps Ethernet link within a week. The packets were separated into unidirectional flow depending on five tuples (srcIP, desIP, Prot, srcPort, desPort) and combined into bi-directional flows from the overlapping time spans of the flows. 19 parameters were computed from the packet headers to be the discriminators for the classification algorithms and all parameters are obtainable in real time from the packet header, without storing the packet. SVM model classified the data with 19 parameters, which has been pretreated using logarithm function. 10-fold cross validation analyzed 4 kernel functions' accuracy and RBF showed highest accuracy, 93.38\%. The classes with more training samples (WWW and service) had low false negative ratios (0.20\% and 0.00\% respectively), which is comparatively smaller than classes with fewer training samples. To find an optimizing discriminator, a sequential forward selection method was used and the weighted average of classification accuracy across all traffic classes is 99.42\%. 99.42\% accuracy has been achieved with regular biased training, 97.17\% with unbiased sample. RBF kernel based SVM model is also applicable to encrypted network traffic and real-time traffic identification. Since supervised machine learning has inadequacy in that it requires a large labeled dataset, they look forward to combining supervised and unsupervised machine learning with feature parameters obtainable early in the traffic flow for fleet and precise internet traffic classification \hyperref[b15]{(Yuan et al., 2008)}.\par
As crimes in computer networks expand, realtime analysis has become essential in network intrusion detection systems (IDS). Enhanced encryption and new ways of avoiding detection led to the need for exquisite classification technology. Traditional method (port based classification) and its advanced method (payload based classification) both showed shortage and thus researchers started to utilize ML in IDS to detect malicious activities.  
\section[{Materials and Methods}]{Materials and Methods} 
\section[{a) Data Description}]{a) Data Description}\par
The dataset is collected from the kaggle website, which is available at https://www.kaggle.com/ sohelranaccselab/trfffffffffffffffff/metadata. This dataset is described in the research paper "Intrusion Detection using Network Traffic Profiling and Machine Learning for IoT Applications". The given data source includes 856 photos of 518 malicious traffic photos and 338 normal traffic photos. It is supposed to perform binary classification. As the dataset contains less images for the deep learning algorithms, we utilized image data generator function from the Keras for the data augmentation. Furthermore, all of the images in the dataset were divided into 255 for the standardi zation (MALICIOUS NETWORK TRAFFIC PCAPS-202, 2021). Convolutional neural network (CNN) is one of the main artificial intelligence(AI) models to recognize and classify images. When the CNN model classifies an image, the image is used as an input and the feature values are extracted by the CNN model as output. Some neurons in the previous layer are connected to individual neurons in the next layer and this local correlation is called the receptive field and forms a weight vector. The regional features are extracted by using a receptive field. Since neurons in the plane share the same weight, similar features at different regions of the input data can be searched. Filter or kernel is the weight vector of CNN which slides the input vector to create the feature map. The method of sliding the filter horizontally and vertically to make weight vectors is called convolutional operation. The convolutional operation extracts features from the input image in a single layer which is representing a unique feature. Due to the local receptive field, the number of parameters to train decreases a lot. Once a feature is detected, the exact region of a feature becomes less important. Then, the pooling layer reduces trainable parameters in order to speed up the operation, prevent over fitting problems and enable translation invariance. At last, a fully connected layer, which has the same shape as a deep neural network (DNN), executes classification \hyperref[b6]{(Indolia et al., 2018)}.  Vanila neural network, so called as an artificial neural network (ANN) or deep neural network (DNN) mainly consists of 3 different layers, including input layers, hidden layers, and output layers. However, as the ANN and DNN have lower performance in computer vision and natural language processing (NLP), novel algorithms were invented for the higher accompli-shment. CNN is the most widely used for computer vision and RNN for the NLP. LSTM and GRU algorithms are representative models of the RNN and they have achieved better performance compared to the vanilla RNN \hyperref[b3]{(Cheon et al., 2021)}. GRU is mainly composed of two gates; reset gate and update gate. The reset gate aims to reset the historical information from the previous hidden layers \hyperref[b4]{(Cho et al., 2014)}. Therefore, after multiplying the value (0, 1) by the previous hidden layer, the sigmoid function is utilized as an activation function of the output. The update gate determines a proportion of both present and past information and the output from the update gate regulates the amount of information at present. In the candidate hidden state, it determines what to erase from the previous time step by multiplying the reset gate and the previous hidden state. Lastly, for the final hidden state, it aims to calculate the hidden layer at the present point by combining the result of the update gate and the result of the candidate hidden state \hyperref[b5]{(Chung et al., 2014)}..  
\section[{Proposed Model}]{Proposed Model}\par
With the aim of enhancing the performance of our model, we combined Xception model, which is a transfer learning method pre-trained with imagenet dataset, and bidirectional GRU. As the bidirectional model allows an end to end training of whole parameters in the model, it has been utilized for the elevated performance. A lambda layer is used for combining the Xception model and bidirectional GRU because the output dimension of the Xception model and the input dimension of the bidirectional GRU are not compatible. The Nadam and binary cross entropy were utilized as optimizer and loss function, respectively.\par
IV. 
\section[{Results}]{Results} 
\section[{a) Comparison of accuracy scores}]{a) Comparison of accuracy scores}\par
Accuracy scores were derived from the diverse machine learning and deep learning algorithms. In the first experiment, accuracy scores for each optimizer, 'Nadam', 'rmsprop', 'adam' and 'SGD' are extracted from the vanilla CNN and the highest one is 86.2\% from 'Nadam' optimizer. Various machine learning classifiers were used instead of fully connected layers of the vanilla CNN for the second experiment. Decision tree classifier brought out 71\%, random forest classifier yielded 86\% and extra tree classifier achieved 87\% of accuracy score. Lastly, while the Xception model with 'adam' attained 62 \% of accuracy score, the 'Xception + Bi-GRU' model brought out a 95.6\% accuracy score, which was the highest one. Furthermore, as shown by the two graphs below, training accuracy is gradually increasing while training loss is gradually decreasing, which shows that training is done flawlessly.     
\section[{Discussion \& Limitation}]{Discussion \& Limitation}\par
Although our experiment was successful, there exist several limitations. Even though deep learning methods and machine learning methods are utilized for various approaches, only tree based machine learning models were used for the classification. Furthermore, another limitation lies on the given dataset which contains relatively fewer images for the deep learning models. For instance, other traffic dataset contains numerous samples of normal traffic data while involving less samples of malicious traffic. Therefore, previous researches conducted classification with anomaly detection algorithms such as local outlier or isolation forest. However, the dataset we used in our experiment has a restriction in that the number of samples is small for both normal and malicious dataset, which hampers us to construct the deep learning models for the anomaly detection. 
\section[{Principal Finding}]{Principal Finding}\par
When it comes to detecting malicious network traffic, we suggest the Xception + Bi-GRU model since it demonstrates a higher accuracy score (95.6\%) than other models. The model showed the highest accuracy score, 4\% higher than Extra Tree Classifier and 5\% higher than the most sophisticated CNN + Machine Learning models. This experiment conducts technical significance by successfully combining CNN based Xception and RNN based Bi-GRU. Our research revealed that hybrid deep learning models surpass the vanilla models when detecting malicious traffic. Furthermore, we detected and visualized the abnormal part of the malicious image via Grad-Cam which made our research have a considerable outcome compared to other existing research. 
\section[{VI.}]{VI.} 
\section[{Conclusion}]{Conclusion}\par
Proposed hybrid model 'Xception + BI-GRU' brought out the highest accuracy score compared to any other AI models. This model showed an accuracy of about 95 percent in classifying the given dataset. With Grad -Cam, we can visualize the reason why our model classified images into specific classes. Our research achieved meaningful results but there also exist several limitations. For combining deep learning and machine learning models for hybrid approach, only tree-based machine learning models were used. In addition, our given dataset contains relatively few images for training the deep learning models, which is not sufficient condition for the adequate experiment. In addition, due to this lack of dataset, we could not apply anomaly detection algorithms which were mainly used in the previous research. Despite these limitations, our experiment reveals that the hybrid model yields a higher accuracy score than implementing a deep learning model solely. Furthermore, Grad-Cam differentiated our research from other research through visualizing the anomaly part of the malicious data. For further research,\begin{figure}[htbp]
\noindent\textbf{1}\includegraphics[]{image-2.png}
\caption{\label{fig_0}Figure 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-3.png}
\caption{\label{fig_1}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2}\includegraphics[]{image-4.png}
\caption{\label{fig_2}Figure 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3}\includegraphics[]{image-5.png}
\caption{\label{fig_3}Figure 3 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{4}\includegraphics[]{image-6.png}
\caption{\label{fig_4}Figure 4 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{5}\includegraphics[]{image-7.png}
\caption{\label{fig_5}Figure 5 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{6}\includegraphics[]{image-8.png}
\caption{\label{fig_6}Figure 6 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{7}\includegraphics[]{image-9.png}
\caption{\label{fig_7}Figure 7 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{89}\includegraphics[]{image-10.png}
\caption{\label{fig_8}Figure 8 :Figure 9 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{10}\includegraphics[]{image-11.png}
\caption{\label{fig_9}Figure 10 :}\end{figure}
 			\footnote{( ) H © 2021 Global Journals} 			\footnote{© 2021 Global Journals} 		 		\backmatter  			 \par
we would attain higher accuracy scores and also construct a CNN based anomaly detection model.			 			  				\begin{bibitemlist}{1}
\bibitem[]{b13}\label{b13} 	 		\textit{},  		 \xref{http://dx.doi.org/10.1109/cvpr.2019.00066}{10.1109/cvpr.2019.00066}.  		 \url{https://doi.org/10.1109/cvpr.2019.00066}  		 	 
\bibitem[Al Khater and Overill ()]{b1}\label{b1} 	 		 			N Al Khater 		,  		 			R E Overill 		.  		\textit{Network traffic classification techniques and challenges},  				2015. 2015.  	 
\bibitem[Yuan et al. ()]{b15}\label{b15} 	 		‘An SVMbased machine learning method for accurate internet traffic classification’.  		 			R Yuan 		,  		 			Z Li 		,  		 			X Guan 		,  		 			L Xu 		.  		 \xref{http://dx.doi.org/10.1007/s10796-008-9131-2}{10.1007/s10796-008-9131-2}.  		 \url{https://doi.org/10.1007/s10796-008-9131-2}  	 	 		\textit{Information Systems Frontiers}  		2008. 12  (2)  p. .  	 
\bibitem[Cheon et al. ()]{b3}\label{b3} 	 		‘Deep learning based hybrid approach of detecting fraudulent transactions’.  		 			M J Cheon 		,  		 			D H Lee 		,  		 			H S Joo 		,  		 			O Lee 		.  	 	 		\textit{Journal of Theoretical and Applied Information Technology}  		2021. 99  (16)  p. .  	 
\bibitem[Chung et al. ()]{b5}\label{b5} 	 		\textit{Empirical evaluation of gated recurrent neural networks on sequence modeling},  		 			J Chung 		,  		 			C Gulcehre 		,  		 			K Cho 		,  		 			Y Bengio 		.  		 arXiv:1412.3555.  		2014.  	 	 (arXiv preprint) 
\bibitem[Selvaraju et al. ()]{b11}\label{b11} 	 		‘Grad-cam: Visual explanations from deep networks via gradientbased localization’.  		 			R R Selvaraju 		,  		 			M Cogswell 		,  		 			A Das 		,  		 			R Vedantam 		,  		 			D Parikh 		,  		 			D Batra 		.  	 	 		\textit{Proceedings of the IEEE international conference on computer vision},  				 (the IEEE international conference on computer vision)  		2017. p. .  	 
\bibitem[Layton (2021)]{b7}\label{b7} 	 		\textit{Hackers Are Targeting U.S. Banks, And Hardware May Give Them An Open Door},  		 			R Layton 		.  		 \url{https://www.forbes.com/sites/roslynlayton/2021/03/17/hackers-are-targeting-us-banks-and-hardware-may-give-them-an-open-door/}  		2021. March 19.  	 
\bibitem[Indolia et al. ()]{b6}\label{b6} 	 		 			S Indolia 		,  		 			A K Goswami 		,  		 			S Mishra 		,  		 			P Asopa 		.  		 \xref{http://dx.doi.org/10.1016/j.procs.2018.05.069}{10.1016/j.procs.2018.05.069}.  		 \url{https://doi.org/10.1016/j.procs.2018.05.069}  		\textit{Conceptual Understanding of Convolutional Neural Network-A Deep Learning Approach. Procedia Computer Science},  				2018. 132 p. .  	 
\bibitem[Sanaei and Sobhani ()]{b10}\label{b10} 	 		‘Information technology and e-business marketing strategy’.  		 			M R Sanaei 		,  		 			F M Sobhani 		.  		 \xref{http://dx.doi.org/10.1007/s10799-018-0289-0}{10.1007/s10799-018-0289-0}.  		 \url{https://doi.org/10.1007/s10799-018-0289-0}  	 	 		\textit{Information Technology and Management}  		2018. 19  (3)  p. .  	 
\bibitem[Rose et al. ()]{b9}\label{b9} 	 		‘Intrusion Detection using Network Traffic Profiling and Machine Learning for IoT’.  		 			J R Rose 		,  		 			M Swann 		,  		 			G Bendiab 		,  		 			S Shiaeles 		,  		 			N Kolokotronis 		.  		 \xref{http://dx.doi.org/10.1109/netsoft51509.2021.9492685}{10.1109/netsoft51509.2021.9492685}.  		 \url{https://doi.org/10.1109/netsoft51509.2021.9492685}  	 	 		\textit{IEEE 7th International Conference on Network Softwarization (NetSoft)},  				2021. 2021.  	 
\bibitem[Statista et al. ()]{b12}\label{b12} 	 		‘Learning Channel-Wise Interactions for Binary Convolutional Neural Networks’.  		 			; Z Statista 		,  		 			J Lu 		,  		 			C Tao 		,  		 			J Zhou 		,  		 			Q Tian 		.  		 \url{https://www.statista.com/statistics/276425/internet-attack-traffic-by-originating-country/Wang}  	 	 		\textit{IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},  				2021. January 25. 2018. 2019. 2019.  	 	 (Leading source countries of web application attack traffic) 
\bibitem[Cho et al. ()]{b4}\label{b4} 	 		\textit{Learning phrase representations using RNN encoder-decoder for statistical machine translation},  		 			K Cho 		,  		 			B Van Merriënboer 		,  		 			C Gulcehre 		,  		 			D Bahdanau 		,  		 			F Bougares 		,  		 			H Schwenk 		,  		 			Y Bengio 		.  		 arXiv:1406.1078.  		2014.  	 	 (arXiv preprint) 
\bibitem[Ahmed and Mahmood ()]{b0}\label{b0} 	 		‘Network traffic analysis based on collective anomaly detection’.  		 			M Ahmed 		,  		 			A N Mahmood 		.  		 \xref{http://dx.doi.org/10.1109/iciea.2014.6931337}{10.1109/iciea.2014.6931337}.  		 \url{https://doi.org/10.1109/iciea.2014.6931337}  	 	 		\textit{9th IEEE Conference on Industrial Electronics and Applications},  				2014. 2014.  	 
\bibitem[Radford et al. ()]{b8}\label{b8} 	 		 			B J Radford 		,  		 			L M Apolonio 		,  		 			A J Trias 		,  		 			J A Simpson 		.  		 arXiv:1803.10769.  		\textit{Network traffic anomaly detection using recurrent neural networks},  				2018.  	 	 (arXiv preprint) 
\bibitem[Tenth International Conference on Digital Information Management (ICDIM)]{b2}\label{b2} 	 		 \xref{http://dx.doi.org/10.1109/icdim.2015.7381869}{10.1109/icdim.2015.7381869}.  		 \url{https://doi.org/10.1109/icdim.2015.7381869}  		\textit{Tenth International Conference on Digital Information Management (ICDIM)},  				 	 
\bibitem[Williams (2021)]{b14}\label{b14} 	 		 			S Williams 		.  		 \url{https://securitybrief.co.nz/story/apac-top-target-for-network-ddos-attacks-report}  		\textit{APAC top target for network DDoS attacks -report. Security Brief},  				2021. September 6.  	 
\end{bibitemlist}
 			 		 	 
\end{document}
