发现加密流量分类中的隐蔽捷径,提升模型泛化能力。
Bias in the Shadows: Explore Shortcuts in Encrypted Network Traffic Classification
- 通过原始字节统计分析,无须依赖具体模型检测捷径特征。
- 在19个公开数据集上验证,有效识别环境相关噪声特征。
- 适合关注安全流量分析可信性的研究人员与工程师。
直接在原始字节上运行的预训练模型在加密网络流量分类(NTC)中表现优异,但常因捷径学习而依赖虚假关联,导致真实场景下泛化能力下降。现有解决方案多依赖特定模型的解释技术,缺乏跨架构与部署场景的通用性。本文提出首个半自动化、模型无关且数据驱动的框架BiasSeeker,用于检测加密流量中的数据集特异性捷径特征。该方法直接对原始二进制流量进行统计相关性分析,独立于任何分类器,识别出可能损害泛化能力的虚假或环境耦合特征。针对捷径特征多样性,我们提出系统分类并采用类别特异性验证策略,在降低偏差的同时保留有意义信息。我们在三个NTC任务的19个公共数据集上评估了BiasSeeker。通过强调上下文感知的特征选择和数据集特异性诊断,该框架为理解与缓解加密流量分类中的捷径学习提供了新视角,提示特征选择应是训练前有意且情境敏感的步骤。
原文摘要 · Abstract (English)
Pre-trained models operating directly on raw bytes have achieved promising performance in encrypted network traffic classification (NTC), but often suffer from shortcut learning-relying on spurious correlations that fail to generalize to real-world data. Existing solutions heavily rely on model-specific interpretation techniques, which lack adaptability and generality across different model architectures and deployment scenarios. In this paper, we propose BiasSeeker, the first semi-automated framework that is both model-agnostic and data-driven for detecting dataset-specific shortcut features in encrypted traffic. By performing statistical correlation analysis directly on raw binary traffic, BiasSeeker identifies spurious or environment-entangled features that may compromise generalization, independent of any classifier. To address the diverse nature of shortcut features, we introduce a systematic categorization and apply category-specific validation strategies that reduce bias while preserving meaningful information. We evaluate BiasSeeker on 19 public datasets across three NTC tasks. By emphasizing context-aware feature selection and dataset-specific diagnosis, BiasSeeker offers a novel perspective for understanding and addressing shortcut learning in encrypted network traffic classification, raising awareness that feature selection should be an intentional and scenario-sensitive step prior to model training.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。