Enhancing early detection and accuracy in image-based network intrusion detection systems

Abstract Efficiently parsing high-volume Packet Capture (PCAP) files for early-stage network intrusion detection remains a persistent challenge in cybersecurity. Real-time environments demand detection systems that are both computationally efficient and capable of accurately identifying complex, multi-packet attacks. Traditional approaches often rely on full flow analysis or deep packet inspection, which are computationally intensive and struggle to generalize under limited training data. This study proposes a novel image-based Network Intrusion Detection System (NIDS) that transforms sequences of five consecutive packets into RGB images, enabling early detection without processing entire traffic flows. The model leverages parallelized PCAP-to-image conversion and integrates domain-aware data augmentation strategies that preserves the semantic structure of network flows. Furthermore, a two-fold stratified cross-validation framework is employed, ensuring robust performance estimation across imbalanced attack categories while mitigating overfitting. Experimental results show that the proposed model, trained on a combined dataset of CICIDS2017 and CICIDS2018, achieve