Abstract
Network traffic analysis is fundamental for network management, troubleshooting, and security. Tasks such as traffic classification, anomaly detection, and novelty discovery are fundamental for extracting operational information from network data and measurements. We witness the shift from deep packet inspection and basic machine learning to Deep Learning (DL) approaches where researchers define and test a custom DL architecture designed for each specific problem. We here advocate the need for a general DL architecture flexible enough to solve different traffic analysis tasks. We test this idea by proposing a DL architecture based on generic data adaptation modules, followed by an integration module that summarises the extracted information into a compact and rich intermediate representation (i.e. embeddings). The result is a flexible Multi-modal Autoencoder (MAE) pipeline that can solve different use cases. We demonstrate the architecture with traffic classification (TC) tasks since they allow us to quantitatively compare results with state-of-the-art solutions. However, we argue that the MAE architecture is generic and can be used to learn representations useful in multiple scenarios. On TC, the MAE performs on par or better than alternatives while avoiding cumbersome feature engineering, thus streamlining the adoption of DL solutions for traffic analysis.
Abstract (translated)
网络流量分析是网络管理、故障排查和安全的基本。诸如流量分类、异常检测和新奇发现等任务是提取网络数据和测量的操作信息的基本方法。我们观察到从深度包检查和基本机器学习向深度学习（DL）方法的转变，研究人员为每个特定问题定义并测试自定义的DL架构。在这里，我们倡导需要一个通用的DL架构，足够灵活以解决不同的流量分析任务。为了验证这个想法，我们提出了一个基于通用数据适应模块的DL架构，然后是一个整合模块，将提取的信息汇总到简洁且丰富的中间表示（即嵌入）中。结果是一个灵活的多模态自动编码器（MAE）管道，可以解决不同的用例。我们用流量分类（TC）任务来展示这个架构，因为它们允许我们定量比较结果与最先进的解决方案。然而，我们认为MAE架构是通用的，可以用于多种场景的学习表示。在TC上，MAE与替代方案表现相当或者更好，同时避免了繁琐的特征工程，从而加速了DL解决方案在流量分析领域的采用。
URL
https://arxiv.org/abs/2405.02649
