arXiv:2503.04174cs.CRcs.LG2025-03中稿 · publication in IEE…被引 7

统一多粒度网络流量建模,提升安全分析精度与效率

UniNet: A Unified Multi-granular Traffic Modeling Framework for Network Security

  • 构建包含会话、流、包级特征的T-Matrix多粒度表示
  • 在四类安全任务中均超越现有方法,误报率更低
  • 适合需要跨场景部署的网络安全研究者使用

随着现代网络日益复杂——由多样化设备、加密协议和不断演变的威胁驱动——网络流量分析变得至关重要。现有机器学习模型通常仅依赖单一层次的数据表示(如数据包或流),难以捕捉对鲁棒分析至关重要的上下文关系。此外,针对监督、半监督和无监督学习设计的任务特定架构导致在不同数据格式和安全任务间适应效率低下。为此,我们提出UniNet,一种统一框架,引入新型多粒度流量表示(T-Matrix),融合会话、流和包级特征,提供全面上下文信息。结合轻量级注意力模型T-Attent,UniNet能高效学习适用于多种安全任务的潜在嵌入表示。在四个关键网络安全部署问题上进行的广泛评估——异常检测、攻击分类、物联网设备识别、加密网站指纹识别——表明,UniNet相较当前最优方法有显著性能提升,实现更高准确率、更低误报率并具备更好可扩展性。通过克服单层次模型的局限性并统一流量分析范式,UniNet为现代网络安全部署设立了新基准。

原文摘要 · Abstract (English)

As modern networks grow increasingly complex--driven by diverse devices, encrypted protocols, and evolving threats--network traffic analysis has become critically important. Existing machine learning models often rely only on a single representation of packets or flows, limiting their ability to capture the contextual relationships essential for robust analysis. Furthermore, task-specific architectures for supervised, semi-supervised, and unsupervised learning lead to inefficiencies in adapting to varying data formats and security tasks. To address these gaps, we propose UniNet, a unified framework that introduces a novel multi-granular traffic representation (T-Matrix), integrating session, flow, and packet-level features to provide comprehensive contextual information. Combined with T-Attent, a lightweight attention-based model, UniNet efficiently learns latent embeddings for diverse security tasks. Extensive evaluations across four key network security and privacy problems--anomaly detection, attack classification, IoT device identification, and encrypted website fingerprinting--demonstrate UniNet's significant performance gain over state-of-the-art methods, achieving higher accuracy, lower false positive rates, and improved scalability. By addressing the limitations of single-level models and unifying traffic analysis paradigms, UniNet sets a new benchmark for modern network security.

网络安全部署多粒度建模流量分析统一框架

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。