  With the widespread adoption of cloud services, especially the extensive
deployment of plenty of Web applications, it is important and challenging to
detect anomalies from the packet payload. For example, the anomalies in the
packet payload can be expressed as a number of specific strings which may cause
attacks. Although some approaches have achieved remarkable progress, they are
with limited applications since they are dependent on in-depth expert
knowledge, e.g., signatures describing anomalies or communication protocol at
the application level. Moreover, they might fail to detect the payload
anomalies that have long-term dependency relationships. To overcome these
limitations and adaptively detect anomalies from the packet payload, we propose
a deep learning based framework which consists of two steps. First, a novel
feature engineering method is proposed to obtain the block-based features via
block sequence extraction and block embedding. The block-based features could
encapsulate both the high-dimension information and the underlying sequential
information which facilitate the anomaly detection. Second, a neural network is
designed to learn the representation of packet payload based on Long Short-Term
Memory (LSTM) and Convolutional Neural Networks (CNN). Furthermore, we cast the
anomaly detection as a classification problem and stack a Multi-Layer
Perception (MLP) on the above representation learning network to detect
anomalies. Extensive experimental results on three public datasets indicate
that our model could achieve a higher detection rate, while keeping a lower
false positive rate compared with five state-of-the-art methods.
