NetFlowGen: Leveraging Generative Pre-training for Network Traffic Dynamics
This work addresses the problem of inefficient and limited generalization in network traffic modeling for automated monitoring systems, though it appears incremental by applying existing pre-training methods to network data.
The paper tackled the challenge of modeling network traffic dynamics efficiently and broadly by proposing NetFlowGen, a generative pre-training framework that uses unlabeled NetFlow data, and it showed promising results in capturing traffic dynamics and adapting to tasks like DDoS attack detection.
Understanding the traffic dynamics in networks is a core capability for automated systems to monitor and analyze networking behaviors, reducing expensive human efforts and economic risks through tasks such as traffic classification, congestion prediction, and attack detection. However, it is still challenging to accurately model network traffic with machine learning approaches in an efficient and broadly applicable manner. Task-specific models trained from scratch are used for different networking applications, which limits the efficiency of model development and generalization of model deployment. Furthermore, while networking data is abundant, high-quality task-specific labels are often insufficient for training individual models. Large-scale self-supervised learning on unlabeled data provides a natural pathway for tackling these challenges. We propose to pre-train a general-purpose machine learning model to capture traffic dynamics with only traffic data from NetFlow records, with the goal of fine-tuning for different downstream tasks with small amount of labels. Our presented NetFlowGen framework goes beyond a proof-of-concept for network traffic pre-training and addresses specific challenges such as unifying network feature representations, learning from large unlabeled traffic data volume, and testing on real downstream tasks in DDoS attack detection. Experiments demonstrate promising results of our pre-training framework on capturing traffic dynamics and adapting to different networking tasks.