BLATTA: Early Exploit Detection on Network Traffic with Recurrent Neural Networks

Figure 4

A detailed view of the classifier. -grams are extracted from the input application layer message, which are then used to train an RNN model to classify whether the connection is malicious or benign.