用QUIC域名识别预训练，实现跨任务交通分类的通用嵌入
Universal Embedding Function for Traffic Classification via QUIC Domain Recognition Pretraining: A Transfer Learning Success
- 在加密QUIC流量中预训练域名识别，生成通用特征表示
- 迁移后在9个下游任务中超越现有最佳性能，平均提升6.4%
- 适合需要快速适配新协议的网络监控与机器学习研究者
加密流量分类（TC）方法需持续适应新协议和扩展，以及机器学习领域的进步。本文采用计算机视觉中成熟的迁移学习框架：先在大规模多类别任务上预训练嵌入模型，再迁移到七个经典TC数据集。预训练任务为识别加密QUIC流量中的SNI域名，该任务因TLS加密客户端问候的普及而日益复杂。训练流程包含独立类别设置、ArcFace损失函数及现代深度架构，旨在生成跨任务通用嵌入。基于模型微调的迁移方法在十个下游任务中的九个上超越当前最优表现，平均提升6.4%。此外，与使用原始包序列的基线方法对比揭示了意外发现，对整个TC领域具有潜在影响。我们已开源模型架构、训练权重及代码库，支持迁移学习实验。
原文摘要 · Abstract (English)
Encrypted traffic classification (TC) methods must adapt to new protocols and extensions as well as to advancements in other machine learning fields. In this paper, we adopt a transfer learning setup best known from computer vision. We first pretrain an embedding model on a complex task with a large number of classes and then transfer it to seven established TC datasets. The pretraining task is recognition of SNI domains in encrypted QUIC traffic, which in itself is a challenge for network monitoring due to the growing adoption of TLS Encrypted Client Hello. Our training pipeline -- featuring a disjoint class setup, ArcFace loss function, and a modern deep learning architecture -- aims to produce universal embeddings applicable across tasks. A transfer method based on model fine-tuning surpassed SOTA performance on nine of ten downstream TC tasks, with an average improvement of 6.4%. Furthermore, a comparison with a baseline method using raw packet sequences revealed unexpected findings with potential implications for the broader TC field. We released the model architecture, trained weights, and codebase for transfer learning experiments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。