分析ChatGPT等AI聊天工具的网络流量,揭示其独特传输模式。
From Prompts to Packets: A View from the Network on ChatGPT, Copilot, and Gemini
- 通过真实用户与受控提示双重数据,捕捉移动应用下的流量特征。
- 发现生成式AI流量具持续上行、高频突发等新压力特征,区别于传统消息应用。
- 强调SNI字段对流量识别至关重要,屏蔽后分类准确率下降20个百分点。
生成式AI聊天机器人正深度融入数字生态,重塑互联网用户交互方式。其始终在线、云端主导的运行模式引入了新型流量动态,对网络管理提出挑战。然而,这类聊天机器人的流量特性仍缺乏系统研究。为此,本研究基于安卓移动应用,深入分析ChatGPT、Copilot和Gemini的流量行为。采用专用捕获架构,构建两套互补数据集:包含自然用户交互与选定文本/图像生成提示的受控负载。该双重设计使我们能够回答关于聊天机器人流量独特性、与传统消息应用差异及其对网络使用的新影响等关键问题。我们提供多粒度流量刻画,并建模数据包序列动态以揭示底层传输机制。结果发现应用与内容相关的流量模式及显著协议特征:TLS占主导,其中Gemini广泛使用QUIC,ChatGPT仅用TLS 1.3,且具有特定的服务器名称指示(SNI)值。通过遮蔽分析量化了对SNI的依赖,表明屏蔽该字段会使分类性能下降高达20个百分点。与传统消息应用对比确认,生成式AI工作负载引入全新压力因素,如持续上行活动与高频率突发流量,直接影响容量规划与网络管理策略。研究数据集已公开,以支持可复现性并拓展至其他场景。
原文摘要 · Abstract (English)
GenAI chatbots are now pervasive in digital ecosystems, fundamentally reshaping user interactions over the Internet. Their reliance on an always-online, cloud-centric operating model introduces novel traffic dynamics that challenge practical network management. Despite the critical need to anticipate these changes in network demand, the traffic characterization of these chatbots remains largely underexplored. To fill this gap, this study presents an in-depth traffic analysis of ChatGPT, Copilot, and Gemini used via Android mobile apps. Using a dedicated capture architecture, we collect two complementary datasets, combining unconstrained user interactions with a controlled workload of selected prompts for both text and image generation. This dual design allows us to address practical research questions on the distinctiveness of chatbot traffic, its divergence from that of conventional messaging apps, and its novel implications for network usage. To this end, we provide a multi-granular traffic characterization and model packet-sequence dynamics to uncover the underlying transmission mechanisms. Our analysis reveals app-/content-specific traffic patterns and distinctive protocol footprints. We highlight the predominance of TLS, with Gemini extensively leveraging QUIC, ChatGPT exclusively using TLS 1.3, and characteristic Server Name Indication (SNI) values. Through occlusion analysis, we quantify the reliance on SNI for traffic visibility, demonstrating that masking this field reduces classification performance by up to 20 percentage points. Finally, the comparison with conventional messaging apps confirms that GenAI workloads introduce novel stress factors, such as sustained upstream activity and high-rate bursts, with direct implications for capacity planning and network management. We publicly release the datasets to support reproducibility and foster extensions to other use cases.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。