用协议感知分词构建无线数据基础模型，让小模型实现大模型的检测能力。
PLUME: Building a Network-Native Foundation Model for Wireless Traces via Protocol-Aware Tokenization
- 按协议层级分词，结合时间间隔与字段归一化，序列长度缩短6.2倍
- 在5类故障上预测准确率达74-97%，异常检测零样本AUC超0.99
- 仅140万参数，单卡运行，适合本地隐私敏感场景
基础模型的成功源于对模态原生结构的学习，如语言中的形态标记或视觉中的像素。无线数据包追踪也应如此：语义来自分层报头、类型字段、时间间隔和跨包状态机，而非扁平字符串。我们提出Plume（802.11数据的协议语言理解模型），一个140M参数的轻量级基础模型，基于结构化的PDML解析训练。其协议感知分词器沿解析器字段树分割，为时间间隔生成间隙标记，并归一化标识符，使序列长度比BPE短6.2倍，且每个标记信息密度更高。在精选语料库上训练后，Plume在五类真实故障中实现74-97%的下一包标记预测准确率，零样本异常检测的AUROC ≥ 0.99。相同预测任务下，前沿大模型（Claude Opus 4.6、GPT-5.4）表现相当，但需超600倍参数量；而Plume仅需单卡部署，边际成本近乎为零，支持本地化、隐私保护的根因分析。
原文摘要 · Abstract (English)
Foundation models succeed when they learn in the native structure of a modality, whether morphology-respecting tokens in language or pixels in vision. Wireless packet traces deserve the same treatment: meaning emerges from layered headers, typed fields, timing gaps, and cross-packet state machines, not flat strings. We present Plume (Protocol Language Understanding Model for Exchanges), a compact 140M-parameter foundation model for 802.11 traces that learns from structured PDML dissections. A protocol-aware tokenizer splits along the dissector field tree, emits gap tokens for timing, and normalizes identifiers, yielding 6.2x shorter sequences than BPE with higher per token information density. Trained on a curated corpus, Plume achieves 74-97% next-packet token accuracy across five real-world failure categories and AUROC >= 0.99 for zero-shot anomaly detection. On the same prediction task, frontier LLMs (Claude Opus 4.6, GPT-5.4) score comparably despite receiving identical protocol context, yet Plume does so with > 600x fewer parameters, fitting on a single GPU at effectively zero marginal cost vs. cloud API pricing, enabling on-prem, privacy-preserving root cause analysis.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。