如何用无标注网络流量数据训练 Transformer 做 App 识别

As the title suggests I'm currently trying to make a modal to identify which app is being used. The thing is I don't have labelled data and generating it is out of question since that is a lot of work ( I need to detect like 3-5K apps give or take)

my data is structured roughly like this:

• Traffic is divided into ~15-second windows/bags.
• Each bag contains multiple network flows.
• Each flow has features such as:
  • domain
  • protocol
  • bytes sent
  • bytes received
  • timestamp/timing information
• I have a very large amount of unlabeled traffic data, but only a relatively small amount of labelled app data for about 100 apps give or take.

The main challenge is that traffic from the same app can look diff between diff window i.e some windows are extremely sparse or empty.

some ideas I have researched looked into are

• self supervised contrastive learning where diff traffic windows from the same session/device activity are treated as positive pairs
• masked modelling similar to bert where parts of the flows such as domains/protocols/byte information are masked and reconstructed
• pretraining an encoder and then fine-tuning it using the smaller labelled dataset (thinking we would need less labelled examples to do that)
• clustering and mapping embeddings to known apps afterward (gradually)

one thing I'm concerned about is accidently teaching the modal to recognize the device/session/user rather then the underlying app

I think I would like to know if I'm thinking about the problem right or if someone has worked on something similar and can give me some pointers or what experiements should I run first.

any papers, architecture or similar problems you think I should look into pls lmk

submitted by /u/AdventurousWear618
[link] [留言]