用预训练模型提升流量分类，更懂协议行为与上下文关系。
FlowletFormer: Network Behavioral Semantic Aware Pre-training Model for Traffic Classification
- 基于BERT设计，分段流量为语义单元，捕捉包间关系。
- 在多个数据集上分类准确率超现有方法，少样本学习能力更强。
- 适合网络分析、安全检测等需要理解传输机制的场景。
基于预训练模型的网络流量分类已展现出良好效果，但现有方法难以捕捉数据包结构特征、流级行为、分层协议语义及包间上下文关系。为此，我们提出FlowletFormer，一种专为网络流量分析设计的BERT型预训练模型。该模型引入一致行为感知的流量表示机制，将流量划分为语义有意义的单元；采用协议栈对齐嵌入层，捕获多层协议语义；设计领域特定且上下文感知的预训练任务，增强包间与流间学习。实验表明，FlowletFormer在流量表征有效性、分类准确率和少样本学习能力方面均显著优于现有方法。通过有效融合领域知识，模型对网络传输原理（如TCP状态连接）有更好理解，为流量分析提供更鲁棒、可信的框架。
原文摘要 · Abstract (English)
Network traffic classification using pre-training models has shown promising results, but existing methods struggle to capture packet structural characteristics, flow-level behaviors, hierarchical protocol semantics, and inter-packet contextual relationships. To address these challenges, we propose FlowletFormer, a BERT-based pre-training model specifically designed for network traffic analysis. FlowletFormer introduces a Coherent Behavior-Aware Traffic Representation Model for segmenting traffic into semantically meaningful units, a Protocol Stack Alignment-Based Embedding Layer to capture multilayer protocol semantics, and Field-Specific and Context-Aware Pretraining Tasks to enhance both inter-packet and inter-flow learning. Experimental results demonstrate that FlowletFormer significantly outperforms existing methods in the effectiveness of traffic representation, classification accuracy, and few-shot learning capability. Moreover, by effectively integrating domain-specific network knowledge, FlowletFormer shows better comprehension of the principles of network transmission (e.g., stateful connections of TCP), providing a more robust and trustworthy framework for traffic analysis.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。