用Transformer和大模型提升网络流量分类准确率，最高达98.95%
Network Traffic Classification Using Machine Learning, Transformer, and Large Language Models
- 融合Transformer与大语言模型，实现多类网络流量自动分类
- XGBoost与Transformer分别达到97.56%和98.95%最高准确率
- 小样本学习下大模型表现亮眼，适合数据稀缺场景
本研究采用多种模型进行网络流量分类，将流量分为网页、浏览、IPSec、备份和邮件五类。数据来自Arbor Edge Defender（AED）设备，共30,959条记录，包含19个特征。评估了朴素贝叶斯、决策树、随机森林、梯度提升、XGBoost、深度神经网络（DNN）、Transformer及两个大语言模型（LLM）GPT-4o和Gemini的零样本与少样本学习能力。结果显示，Transformer和XGBoost性能最佳，准确率分别为98.95%和97.56%。GPT-4o与Gemini在少样本学习下显著提升准确率，尤其在网页和邮件类别表现良好；但在IPSec和备份等复杂类别上仍出现误判。研究强调模型选择、微调以及训练数据量与模型复杂度之间的平衡对可靠分类至关重要。
原文摘要 · Abstract (English)
This study uses various models to address network traffic classification, categorizing traffic into web, browsing, IPSec, backup, and email. We collected a comprehensive dataset from Arbor Edge Defender (AED) devices, comprising of 30,959 observations and 19 features. Multiple models were evaluated, including Naive Bayes, Decision Tree, Random Forest, Gradient Boosting, XGBoost, Deep Neural Networks (DNN), Transformer, and two Large Language Models (LLMs) including GPT-4o and Gemini with zero- and few-shot learning. Transformer and XGBoost showed the best performance, achieving the highest accuracy of 98.95 and 97.56%, respectively. GPT-4o and Gemini showed promising results with few-shot learning, improving accuracy significantly from initial zero-shot performance. While Gemini Few-Shot and GPT-4o Few-Shot performed well in categories like Web and Email, misclassifications occurred in more complex categories like IPSec and Backup. The study highlights the importance of model selection, fine-tuning, and the balance between training data size and model complexity for achieving reliable classification results.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。