提出TraceCodec,用编译器辅助生成高保真网络流量数据,解决传统方法扭曲状态的问题。
TraceCodec: A Compiler-Backed Neural Codec for Stateful Multi-Flow Network Traffic Traces

- 将报文转化为带时序的动作,显式管理流槽与传输线索
- 在CICIDS2017上实现99.97%的包数、协议组成和流数量匹配度
- 适合网络安全测试与协议验证,支持多流状态保持
关键网络任务需要高保真包捕获(PCAP)用于测试、安全分析和协议验证,而非仅依赖统计流级摘要。现有包生成器虽能约束协议生成PCAP,但直接解码为原始包字段,导致学习到的行为选择与确定性协议结果纠缠,迫使包生成依赖后期启发式修复。本文识别此解码接口为根本瓶颈,提出TraceCodec——一种面向有状态多流追踪的神经编解码器。它将每个包提升为带时间戳的包动作,显式标注流槽与传输提示,并学习连续的每包潜在表示。一个确定性编译器将解码动作还原为PCAP,负责端点分配、TCP状态、合法性约束及包渲染。潜在层暴露生成器可操作的序列空间,使下游流量模型可在包动作潜在空间中运行,而非原始头部字段。在CICIDS2017 Monday数据集上,TraceCodec在相同无修复策略下,包数、协议构成与流数量匹配误差低于0.03%;而原始字段基线模型则使流数量与TCP状态畸变达数量级。结构诊断显示,TraceCodec有效保留了TCP状态转移与多流交错特性,而原始字段解码器会破坏这些结构。本工作建立了高保真包追踪生成的新范式。
原文摘要 · Abstract (English)
Critical networking workflows require high-fidelity packet captures (PCAPs) for testing, security analysis, and protocol validation, not just statistical flow-level summaries. Recent packet generators have demonstrated protocol-constrained PCAP synthesis, but they universally decode directly to raw packet fields. That interface entangles learned behavioral choices with deterministic protocol consequences, which forces packet realization to depend on post-hoc heuristic repair. We identify this decode interface as the fundamental bottleneck and present TraceCodec, a state-aware neural codec for stateful multi-flow traces. TraceCodec lifts each packet into a timed packet action with explicit flow slots and transport cues, then learns a continuous per-packet latent. A deterministic compiler lowers decoded actions back to PCAPs, owning endpoint assignment, TCP state, legality constraints, and packet rendering. The latent layer exposes a generator-facing sequence space, so downstream traffic models can operate on packet-action latents rather than raw header fields. On CICIDS2017 Monday, TraceCodec matches packet count, protocol composition, and flow population to within 0.03%. Raw-field baselines under the same non-repair policy distort flow counts and TCP state by orders of magnitude. Structural diagnostics show that TraceCodec preserves TCP state transitions and multi-flow interleaving that raw-field decoders fragment. This work establishes a new foundation for high-fidelity packet-trace generation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。