Network Anomaly Detection Using Image Processing Techniques
Mário Guilherme de Almeida Martins Sequeira Lemos
MSc Thesis · 2025 · University of Coimbra
Supervisors: Paulo Simões, Tiago Cruz, Marco Carli, Sara Baldoni
Abstract
This research project is dedicated to the development of a network anomaly detection solution, that utilizes image processing techniques. It is intended to establish an intelligent system that can detect cyber-attack instances by analyzing network traffic data. The decision to use a Two-Dimensional (2D) representation derived from the understanding of the efficiency of creating a concise characterization of multi-input information, such as traffic data. By transforming the network flows into images, we can then analyze them as a sequence of frames, allowing for the application of image processing techniques. The research is focused on two types of cyber attacks, namely Port Scanning and Denial of Service. For the image creation process, a balanced four-channel heatmap approach was utilized, allowing for the retention of spatial and behavioral features of the network. Two different approaches for the detection of attacks were presented: an image-per-attack and a single-image solution. A Convolutional Neural Network (CNN) was utilized for its ability to learn features from images, such as the ones created. The evaluation of the system was conducted using the UGR’16 dataset, which provided realistic background traffic combined with labeled attack scenarios. The proposed approaches consistently achieved high performance, with classification results reaching approximately 99% in both accuracy and precision across attack categories. While these results demonstrate the effectiveness of the methodology, it is crucial to acknowledge the limitations regarding generalization.