Reconstructing Fine-Grained Network Data using Autoencoder Architectures with Domain Knowledge Penalties
This addresses data storage and privacy challenges for network security practitioners, though it appears incremental as it builds on existing autoencoder methods.
The paper tackles the problem of reconstructing fine-grained network session data from coarse-grained feature vectors to improve network security models, demonstrating that incorporating domain knowledge through constraint-based loss terms significantly improves reconstruction accuracy for categorical features with session-level encodings.
The ability to reconstruct fine-grained network session data, including individual packets, from coarse-grained feature vectors is crucial for improving network security models. However, the large-scale collection and storage of raw network traffic pose significant challenges, particularly for capturing rare cyberattack samples. These challenges hinder the ability to retain comprehensive datasets for model training and future threat detection. To address this, we propose a machine learning approach guided by formal methods to encode and reconstruct network data. Our method employs autoencoder models with domain-informed penalties to impute PCAP session headers from structured feature representations. Experimental results demonstrate that incorporating domain knowledge through constraint-based loss terms significantly improves reconstruction accuracy, particularly for categorical features with session-level encodings. By enabling efficient reconstruction of detailed network sessions, our approach facilitates data-efficient model training while preserving privacy and storage efficiency.