In the ever-evolving realm of network security, the swift and accurate identification of diverse attack classes within network traffic is of paramount importance. This paper introduces “ByteStack-ID,” a pioneering approach tailored for packet-level intrusion detection. At its core, ByteStack-ID leverages grayscale images generated from the frequency distributions of payload data, a groundbreaking technique that greatly enhances the model's ability to discern intricate data patterns. Notably, our approach is exclusively grounded in packet-level information, a departure from conventional Network Intrusion Detection Systems (NIDS) that predominantly rely on flow-based data. While building upon the fundamental concept of stacking methodology, ByteStack-ID diverges from traditional stacking approaches. It seamlessly integrates additional meta learner layers into the concatenated base learners, creating a highly optimized, unified model. Empirical results unequivocally confirm the outstanding effectiveness of the ByteStack-ID framework, consistently outperforming baseline models and state-of-the-art approaches across pivotal performance metrics, including precision, recall, and F1-score. Impressively, our proposed approach achieves an exceptional 81% macro F1-score in multiclass classification tasks. In a landscape marked by the continuous evolution of network threats, ByteStack-ID emerges as a robust and versatile security solution, relying solely on packet-level information extracted from network traffic data.

Adapting modern approaches for network intrusion detection is becoming critical, given the rapid technological advancement and adversarial attack rates. Therefore, packet-based methods utilizing payload data are gaining much popularity due to their effectiveness in detecting certain attacks. However, packet-based approaches suffer from a lack of standardization, resulting in incomparability and reproducibility issues. Unlike flow-based datasets, no standard labeled dataset exists, forcing researchers to follow bespoke labeling pipelines for individual approaches. Without a standardized baseline, proposed approaches cannot be compared and evaluated with each other. One cannot gauge whether the proposed approach is a methodological advancement or is just being benefited from the proprietary interpretation of the dataset. Addressing comparability and reproducibility issues, we introduce Payload-Byte, an open-source tool for extracting and labeling network packets in this work. Payload-Byte utilizes metadata information and labels raw traffic captures of modern intrusion detection datasets in a generalized manner. Moreover, we transformed the labeled data into a byte-wise feature vector that can be utilized for training machine learning models. The whole cycle of processing and labeling is explicitly stated in this work. Furthermore, source code and processed data are made publicly available so that it may act as a standardized baseline for future research work. Lastly, we present a brief comparative analysis of machine learning models trained on packet-based and flow-based data.

Microgrids specialized for tactical operations have been subjected to several challenges. These tactical power networks are islanded and have a relatively low power generation capacity. Meeting power requirements of military equipment, having intermittent and highly inductive nature, exposes microgrids to severe stresses. Existing methodologies to monitor and control the impact of load variations require sophisticated equipment and trained personnel. The objective of this research paper is to present an open-source edge energy monitoring system (EEMS) for efficient demand management of tactical networks. The proposed system is capable of capturing all minute operational artifacts, including harmonic distortions and power quality of these networks. A variable gain amplifier circuit enables the proposed EMS to sense all the signals in a wide range of power with higher resolution. The proposed system utilizes raspberry pi as an edge device to meet the low power requirements of tactical networks. The novel concurrent programming approach adopted in the proposed EMS, effectively handles the large amount of data acquired from the network. This parallel processing of acquired data speeds up the execution process. All electrical parameters obtained during this process are stored in an encrypted local database that can be utilized for fault analysis and load prediction. Further integration of machine learning tools in proposed EMS assists in automated power network reconfiguration and tuning under harsh battlefield situations.