arXiv:2412.20635cs.LGcs.AI2024-12被引 5

用NetFlow数据预训练模型,让小标签也能高效完成网络流量分析。

NetFlowGen: Leveraging Generative Pre-training for Network Traffic Dynamics

  • 基于NetFlow无标签数据预训练通用模型,统一特征表示。
  • 在真实DDoS攻击检测任务中表现优异,仅需少量标签即可微调。
  • 适合需要快速部署的网络监控、安全检测等场景。

理解网络流量动态是自动化系统监测和分析网络行为的核心能力,可减少人力成本与经济风险,应用于流量分类、拥塞预测和攻击检测等任务。然而,现有机器学习方法在高效且普适地建模网络流量方面仍面临挑战。当前多采用为特定任务从零训练模型,导致开发效率低、模型泛化差;同时,尽管网络数据丰富,高质量的标注数据却常不足。大规模自监督学习为解决此问题提供了自然路径。我们提出NetFlowGen框架,仅使用NetFlow记录中的原始流量数据进行通用预训练,目标是在下游任务中仅用少量标签即可微调。该框架不仅验证了网络流量预训练的可行性,还解决了特征表示统一、海量无标签数据学习及真实任务测试(如DDoS攻击检测)等关键挑战。实验表明,该预训练框架能有效捕捉流量动态,并适应多种网络任务。

原文摘要 · Abstract (English)

Understanding the traffic dynamics in networks is a core capability for automated systems to monitor and analyze networking behaviors, reducing expensive human efforts and economic risks through tasks such as traffic classification, congestion prediction, and attack detection. However, it is still challenging to accurately model network traffic with machine learning approaches in an efficient and broadly applicable manner. Task-specific models trained from scratch are used for different networking applications, which limits the efficiency of model development and generalization of model deployment. Furthermore, while networking data is abundant, high-quality task-specific labels are often insufficient for training individual models. Large-scale self-supervised learning on unlabeled data provides a natural pathway for tackling these challenges. We propose to pre-train a general-purpose machine learning model to capture traffic dynamics with only traffic data from NetFlow records, with the goal of fine-tuning for different downstream tasks with small amount of labels. Our presented NetFlowGen framework goes beyond a proof-of-concept for network traffic pre-training and addresses specific challenges such as unifying network feature representations, learning from large unlabeled traffic data volume, and testing on real downstream tasks in DDoS attack detection. Experiments demonstrate promising results of our pre-training framework on capturing traffic dynamics and adapting to different networking tasks.

流量分析预训练自监督

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。