用对比学习自动识别扫描器流量序列的关联关系。
Contrastive Learning and Correlation Clustering for Sequences of Network Telescope Data
- 用Transformer模型对网络流数据做无预训练对比学习嵌入
- 同源序列相似度显著高于异源序列，且泛化到未见源
- 局部相关聚类能有效还原扫描器标签，适合安全分析
理解互联网扫描器行为具有挑战性，常需识别源之间的关联，但语义标注稀缺。本文研究是否可通过对比学习，在无需预训练和标注的情况下，估计网络流量记录序列间的语义有意义的成对关系。为此，提出一种Transformer模型，对少量预处理的网络流序列进行嵌入，并采用对比学习进行训练。基于模型得到的相似度，构建相关聚类问题并局部求解。实验表明：来自同一源的序列间相似度平均更高，该特性可推广至未见源的未见序列；相关聚类结果与扫描器标签一致。算法完整代码及复现实验材料已公开。
原文摘要 · Abstract (English)
Understanding activities of Internet scanners is challenging; it often requires identifying relationships between sources, a task for which semantic annotations are scarce. This work investigates whether semantically meaningful pairwise relationships between sequences of network flow records can be estimated by contrastive learning, without pretraining and without annotations. To this end, we propose a transformer model that embeds minimally preprocessed sequences of network flow records and train it using contrastive learning. With the similarities obtained from this model, we state a correlation clustering problem and solve it locally. Experimentally, we show: Learned similarities are higher on average for sequences originating from the same source than for sequences originating from different sources, and this property generalizes to unseen sequences of unseen sources. Moreover, correlation clustering yields clusters consistent with scanner labels. The complete source code of the algorithms and for reproducing the experiments is publicly available.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。