Behavioral analysis and machine learning for proactive network threat detection

This study explores Network Behavior Analysis (NBA) by transforming network traffic data into image representations for machine learning-based threat detection, with a focus on Distributed Denial-of-Service (DDoS) attacks. Rather than operating directly on tabular features, this work evaluates multiple tabular-to-image transformation techniques using a behaviorally enriched representation of the publicly available BCCC dataset. The goal is a system that identifies potential attack sources, supports network administrators in audit processes and equipment configuration, and can also serve as a forensic tool for identifying user behavior patterns. The data, containing both benign and malicious activity, were processed through one-hot encoding to generate images representing IP behavior. Four transformation techniques were applied: Refined, DeepInsight, Tabular Convolution (TAC), and IGTD (Image Generator for Tabular Data). Convolutional Neural Networks (CNNs) were then used to analyze the images and compare the effectiveness of each method. Results show that image-based representations effectively capture suspicious network behavior, with Refined achieving the strongest overall performance. These findings highlight tabular-to-image learning as a promising approach for proactive network threat detection, supporting better decision-making, faster incident response, and more efficient security operations.