用图模型分析网络流量，预训练后少样本学习效果提升6.87%
Towards a graph-based foundation model for network traffic analysis
- 将流量建模为动态时空图，用自监督链接预测预训练
- 少样本下游任务平均性能比从零训练高6.87%
- 适合网络安全、流量分类等需要泛化能力的场景
基础模型在多个领域展现出巨大潜力。一个潜在应用是计算机网络流量分析，这类模型能捕捉网络流量的复杂动态，并通过少量微调适应特定任务或网络环境。以往方法使用分词后的十六进制包数据和大型语言模型架构。本文提出一种新的、高效的流级别图基替代方案。该方法将网络流量表示为动态时空图，采用自监督链接预测预训练任务来捕捉网络图框架中的时空动态。为评估该方法的有效性，我们在三个不同的下游任务上进行了少样本学习实验：入侵检测、流量分类和僵尸网络分类。从预训练模型微调的模型在平均性能上比从零训练高出6.87%，证明其在预训练阶段能有效学习通用网络流量动态。这一成功表明，构建大规模版本有望成为实际运营的基础模型。
原文摘要 · Abstract (English)
Foundation models have shown great promise in various fields of study. A potential application of such models is in computer network traffic analysis, where these models can grasp the complexities of network traffic dynamics and adapt to any specific task or network environment with minimal fine-tuning. Previous approaches have used tokenized hex-level packet data and the model architecture of large language transformer models. We propose a new, efficient graph-based alternative at the flow-level. Our approach represents network traffic as a dynamic spatio-temporal graph, employing a self-supervised link prediction pretraining task to capture the spatial and temporal dynamics in this network graph framework. To evaluate the effectiveness of our approach, we conduct a few-shot learning experiment for three distinct downstream network tasks: intrusion detection, traffic classification, and botnet classification. Models finetuned from our pretrained base achieve an average performance increase of 6.87\% over training from scratch, demonstrating their ability to effectively learn general network traffic dynamics during pretraining. This success suggests the potential for a large-scale version to serve as an operational foundational model.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。