建立基于图形的网络流量分析基础模型

Louis Van Langendonck, Ismael Castell-Uroz, Pere Barlet-Ros
{"title":"建立基于图形的网络流量分析基础模型","authors":"Louis Van Langendonck, Ismael Castell-Uroz, Pere Barlet-Ros","doi":"arxiv-2409.08111","DOIUrl":null,"url":null,"abstract":"Foundation models have shown great promise in various fields of study. A\npotential application of such models is in computer network traffic analysis,\nwhere these models can grasp the complexities of network traffic dynamics and\nadapt to any specific task or network environment with minimal fine-tuning.\nPrevious approaches have used tokenized hex-level packet data and the model\narchitecture of large language transformer models. We propose a new, efficient\ngraph-based alternative at the flow-level. Our approach represents network\ntraffic as a dynamic spatio-temporal graph, employing a self-supervised link\nprediction pretraining task to capture the spatial and temporal dynamics in\nthis network graph framework. To evaluate the effectiveness of our approach, we\nconduct a few-shot learning experiment for three distinct downstream network\ntasks: intrusion detection, traffic classification, and botnet classification.\nModels finetuned from our pretrained base achieve an average performance\nincrease of 6.87\\% over training from scratch, demonstrating their ability to\neffectively learn general network traffic dynamics during pretraining. This\nsuccess suggests the potential for a large-scale version to serve as an\noperational foundational model.","PeriodicalId":501280,"journal":{"name":"arXiv - CS - Networking and Internet Architecture","volume":null,"pages":null},"PeriodicalIF":0.0000,"publicationDate":"2024-09-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":"{\"title\":\"Towards a graph-based foundation model for network traffic analysis\",\"authors\":\"Louis Van Langendonck, Ismael Castell-Uroz, Pere Barlet-Ros\",\"doi\":\"arxiv-2409.08111\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"Foundation models have shown great promise in various fields of study. A\\npotential application of such models is in computer network traffic analysis,\\nwhere these models can grasp the complexities of network traffic dynamics and\\nadapt to any specific task or network environment with minimal fine-tuning.\\nPrevious approaches have used tokenized hex-level packet data and the model\\narchitecture of large language transformer models. We propose a new, efficient\\ngraph-based alternative at the flow-level. Our approach represents network\\ntraffic as a dynamic spatio-temporal graph, employing a self-supervised link\\nprediction pretraining task to capture the spatial and temporal dynamics in\\nthis network graph framework. To evaluate the effectiveness of our approach, we\\nconduct a few-shot learning experiment for three distinct downstream network\\ntasks: intrusion detection, traffic classification, and botnet classification.\\nModels finetuned from our pretrained base achieve an average performance\\nincrease of 6.87\\\\% over training from scratch, demonstrating their ability to\\neffectively learn general network traffic dynamics during pretraining. This\\nsuccess suggests the potential for a large-scale version to serve as an\\noperational foundational model.\",\"PeriodicalId\":501280,\"journal\":{\"name\":\"arXiv - CS - Networking and Internet Architecture\",\"volume\":null,\"pages\":null},\"PeriodicalIF\":0.0000,\"publicationDate\":\"2024-09-12\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"0\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"arXiv - CS - Networking and Internet Architecture\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/arxiv-2409.08111\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"\",\"JCRName\":\"\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"arXiv - CS - Networking and Internet Architecture","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/arxiv-2409.08111","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 0

摘要

基础模型在各个研究领域都大有可为。此类模型的一个潜在应用领域是计算机网络流量分析,这些模型可以把握复杂的网络流量动态,并以最小的微调适应任何特定任务或网络环境。我们提出了一种新的、高效的基于图的流量级替代方法。我们的方法将网络流量表示为动态时空图,采用自监督链接预测预训练任务来捕捉网络图框架中的时空动态。为了评估我们方法的有效性,我们针对三种不同的下游网络任务(入侵检测、流量分类和僵尸网络分类)进行了少量学习实验。根据我们的预训练基础对模型进行微调后,模型的平均性能比从头开始训练时提高了 6.87%,这表明它们能够在预训练期间有效地学习一般网络流量动态。这一成功表明,大规模版本有可能成为可操作的基础模型。
本文章由计算机程序翻译,如有差异,请以英文原文为准。
Towards a graph-based foundation model for network traffic analysis
Foundation models have shown great promise in various fields of study. A potential application of such models is in computer network traffic analysis, where these models can grasp the complexities of network traffic dynamics and adapt to any specific task or network environment with minimal fine-tuning. Previous approaches have used tokenized hex-level packet data and the model architecture of large language transformer models. We propose a new, efficient graph-based alternative at the flow-level. Our approach represents network traffic as a dynamic spatio-temporal graph, employing a self-supervised link prediction pretraining task to capture the spatial and temporal dynamics in this network graph framework. To evaluate the effectiveness of our approach, we conduct a few-shot learning experiment for three distinct downstream network tasks: intrusion detection, traffic classification, and botnet classification. Models finetuned from our pretrained base achieve an average performance increase of 6.87\% over training from scratch, demonstrating their ability to effectively learn general network traffic dynamics during pretraining. This success suggests the potential for a large-scale version to serve as an operational foundational model.
求助全文
通过发布文献求助,成功后即可免费获取论文全文。 去求助
来源期刊
自引率
0.00%
发文量
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
确定
请完成安全验证×
copy
已复制链接
快去分享给好友吧!
我知道了
右上角分享
点击右上角分享
0
联系我们:info@booksci.cn Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术官方微信