提出新型表格化预训练范式,提升加密流量分类效果。
Where Do Flow Semantics Reside? A Protocol-Native Tabular Pretraining Paradigm for Encrypted Traffic Classification
- 以协议字段语义为先验,构建表格化自监督模型
- 仅用一半标注数据,性能超越多数全量训练方法
- 适合需要低标注成本的网络流量分析场景
自监督掩码建模在加密流量分类中展现潜力,通过掩码和重建原始字节实现。然而近期研究发现,尽管预训练成本高昂,这些方法仍难以减少对标注数据的依赖:在冻结编码器评估下,准确率从0.9以上降至0.47以下。我们指出根本原因在于归纳偏置不匹配——将流量扁平为字节序列破坏了协议定义的语义结构。具体表现为:1)字段不可预测性,如ip.id等随机字段本不可学习却仍被当作重建目标;2)嵌入混淆,语义不同的字段在统一嵌入空间中坍缩;3)元数据丢失,捕获时间元数据对时序分析至关重要却被丢弃。为此,我们提出协议原生范式,将协议定义的字段语义作为架构先验,重构任务以契合数据内在的表格模态,而非逐步适应序列架构。基于此范式,我们提出FlowSem-MAE,一种基于流语义单元(FSUs)的表格掩码自编码器。其包含可预测性引导过滤、针对FSU的专属嵌入,以及双轴注意力以捕捉包内与时序模式。在多个数据集上显著优于现有方法,仅用一半标注数据即超越多数全数据训练模型。
原文摘要 · Abstract (English)
Self-supervised masked modeling shows promise for encrypted traffic classification by masking and reconstructing raw bytes. Yet recent work reveals these methods fail to reduce reliance on labeled data despite costly pretraining: under frozen encoder evaluation, accuracy drops from greater than 0.9 to less than 0.47. We argue the root cause is inductive bias mismatch: flattening traffic into byte sequences destroys protocol-defined semantics. We identify three specific issues: 1) field unpredictability, random fields like ip.id are unlearnable yet treated as reconstruction targets; 2) embedding confusion, semantically distinct fields collapse into a unified embedding space; 3) metadata loss, capture-time metadata essential for temporal analysis is discarded. To address this, we propose a protocol-native paradigm that treats protocol-defined field semantics as architectural priors, reformulating the task to align with the data's intrinsic tabular modality rather than incrementally adapting sequence-based architectures. Instantiating this paradigm, we introduce FlowSem-MAE, a tabular masked autoencoder built on Flow Semantic Units (FSUs). It features predictability-guided filtering that focuses on learnable FSUs, FSU-specific embeddings to preserve field boundaries, and dual-axis attention to capture intra-packet and temporal patterns. FlowSem-MAE significantly outperforms state-of-the-art across datasets. With only half labeled data, it outperforms most existing methods trained on full data.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。