用大模型提升加密流量分类鲁棒性，应对数据分布变化。
Respond to Change with Constancy: Instruction-tuning with LLM for Non-I.I.D. Network Traffic Classification
- 通过自监督指令微调，让大模型理解流量结构与文本信息关联。
- 在非独立同分布场景下F1最高提升18.17%，零样本分类性能显著增强。
- 适合网络安全部署，尤其适用于标签稀缺或分布动态变化的环境。
加密流量分类在网络安全中极具挑战性，因其需从内容无关的流量数据中提取稳健特征。现有方法面临两大瓶颈：(i) 分布漂移问题，源于封闭世界假设，限制了对真实世界动态模式的适应能力；(ii) 对标注数据依赖性强，导致在数据稀缺或不可用时难以应用。大型语言模型（LLMs）在多项任务中展现出强大的泛化能力，但在流量分析领域仍受限于对特定需求的适配困难。本文提出一种新型流量表示模型——基于大模型的加密流量域外指令微调（ETooL），通过自监督指令微调融合大模型与流量结构知识，建立文本信息与流量交互之间的联系。ETooL在监督与零样本分类任务中均表现出更强的鲁棒性与泛化能力。显著提升F1得分：APP53（I.I.D.）从6.62%增至93.19%，O.O.D.从18.17%增至74.88%；ISCX-Botnet（O.O.D.）从9.16%增至95.03%。同时构建了支持动态分布偏移的NETD数据集，验证ETooL在多变分布条件下的有效性，并评估其指令微调带来的效率优势。
原文摘要 · Abstract (English)
Encrypted traffic classification is highly challenging in network security due to the need for extracting robust features from content-agnostic traffic data. Existing approaches face critical issues: (i) Distribution drift, caused by reliance on the closedworld assumption, limits adaptability to realworld, shifting patterns; (ii) Dependence on labeled data restricts applicability where such data is scarce or unavailable. Large language models (LLMs) have demonstrated remarkable potential in offering generalizable solutions across a wide range of tasks, achieving notable success in various specialized fields. However, their effectiveness in traffic analysis remains constrained by challenges in adapting to the unique requirements of the traffic domain. In this paper, we introduce a novel traffic representation model named Encrypted Traffic Out-of-Distribution Instruction Tuning with LLM (ETooL), which integrates LLMs with knowledge of traffic structures through a self-supervised instruction tuning paradigm. This framework establishes connections between textual information and traffic interactions. ETooL demonstrates more robust classification performance and superior generalization in both supervised and zero-shot traffic classification tasks. Notably, it achieves significant improvements in F1 scores: APP53 (I.I.D.) to 93.19%(6.62%) and 92.11%(4.19%), APP53 (O.O.D.) to 74.88%(18.17%) and 72.13%(15.15%), and ISCX-Botnet (O.O.D.) to 95.03%(9.16%) and 81.95%(12.08%). Additionally, we construct NETD, a traffic dataset designed to support dynamic distributional shifts, and use it to validate ETooL's effectiveness under varying distributional conditions. Furthermore, we evaluate the efficiency gains achieved through ETooL's instruction tuning approach.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。