arXivDaily arXiv每日学术速递 周一至周五更新
arXiv周末暂无论文更新,休息一下吧,周末愉快~~
arXiv 2402.03646cs.LGcs.NI
收藏

Lens: 一种基于知识的网络流量基础模型

Lens: A Knowledge-Guided Foundation Model for Network Traffic

Xiaochang Li, Chen Qian, Qineng Wang, Jiangtao Kong, Yuchen Wang, Ziyu Yao, Bo Ji, Long Cheng, Gang Zhou, Huajie Shao

AI总结:

Lens提出了一种基于知识的网络流量基础模型,通过知识引导的预训练和上下文感知微调,在分类和生成任务中均取得优异性能。

摘要:

网络流量指的是在互联网或任何连接计算机的系统中传输和接收的数据量。分析网络流量对于安全和管理至关重要,但仍然具有挑战性,因为纯文本数据包头和加密负载的异质性。为了捕捉流量的潜在语义,最近的研究采用了基于Transformer的预训练技术来从大量流量数据中学习网络表示。然而,这些方法在数据驱动的任务上进行预训练,但忽略了网络知识,例如在预测时对不可分割的网络端口号部分数字进行遮蔽,从而限制了语义理解。此外,它们在微调过程中难以扩展到新类别,因为存在分布偏移。受这些限制的启发,我们提出了Lens,一种统一的知识引导基础模型,用于网络流量分类和生成。在预训练中,我们提出了一种带有文本上下文的知识引导遮蔽跨度预测方法,以学习知识丰富的表示。为了在微调中扩展到新类别,我们将流量分类重新表述为一个封闭生成任务,并引入了上下文感知微调以适应分布偏移。在各种基准数据集上的评估结果表明,所提出的Lens在分类和生成任务上均取得了优越的性能。对于流量分类,Lens在12项任务中的8项上显著优于竞争基线,平均准确率为96.33%。并且能够扩展到新类别,表现出显著更好的性能。对于流量生成,Lens生成了更高质量的网络流量用于网络模拟,在模糊测试中获得了高达30.46%和33.3%的准确率和F1值提升。我们将在发表时开源代码。

英文摘要:

Network traffic refers to the amount of data being sent and received over the Internet or any system that connects computers. Analyzing network traffic is vital for security and management, yet remains challenging due to the heterogeneity of plain-text packet headers and encrypted payloads. To capture the latent semantics of traffic, recent studies have adopted Transformer-based pretraining techniques to learn network representations from massive traffic data. However, these methods pre-train on data-driven tasks but overlook network knowledge, such as masking partial digits of the indivisible network port numbers for prediction, thereby limiting semantic understanding. In addition, they struggle to extend classification to new classes during fine-tuning due to the distribution shift. Motivated by these limitations, we propose \Lens, a unified knowledge-guided foundation model for both network traffic classification and generation. In pretraining, we propose a Knowledge-Guided Mask Span Prediction method with textual context for learning knowledge-enriched representations. For extending to new classes in finetuning, we reframe the traffic classification as a closed-ended generation task and introduce context-aware finetuning to adapt to the distribution shift. Evaluation results across various benchmark datasets demonstrate that the proposed Lens~achieves superior performance on both classification and generation tasks. For traffic classification, Lens~outperforms competitive baselines substantially on 8 out of 12 tasks with an average accuracy of \textbf{96.33\%} and extends to novel classes with significantly better performance. For traffic generation, Lens~generates better high-fidelity network traffic for network simulation, gaining up to \textbf{30.46\%} and \textbf{33.3\%} better accuracy and F1 in fuzzing tests. We will open-source the code upon publication.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑