Generic Multi-modal Representation Learning for Network Traffic Analysis

TL;DR

This paper proposes a flexible, general deep learning architecture called Multi-modal Autoencoder (MAE) for network traffic analysis, capable of handling various tasks like classification and anomaly detection without extensive feature engineering.

Contribution

The paper introduces a novel generic DL architecture that unifies multiple traffic analysis tasks into a single flexible framework using data adaptation and embedding modules.

Findings

MAE performs on par or better than state-of-the-art methods in traffic classification.

The architecture reduces the need for manual feature engineering.

MAE demonstrates versatility across different network traffic analysis scenarios.

Abstract

Network traffic analysis is fundamental for network management, troubleshooting, and security. Tasks such as traffic classification, anomaly detection, and novelty discovery are fundamental for extracting operational information from network data and measurements. We witness the shift from deep packet inspection and basic machine learning to Deep Learning (DL) approaches where researchers define and test a custom DL architecture designed for each specific problem. We here advocate the need for a general DL architecture flexible enough to solve different traffic analysis tasks. We test this idea by proposing a DL architecture based on generic data adaptation modules, followed by an integration module that summarises the extracted information into a compact and rich intermediate representation (i.e. embeddings). The result is a flexible Multi-modal Autoencoder (MAE) pipeline that can solve different use cases. We demonstrate the architecture with traffic classification (TC) tasks since they allow us to quantitatively compare results with state-of-the-art solutions. However, we argue that the MAE architecture is generic and can be used to learn representations useful in multiple scenarios. On TC, the MAE performs on par or better than alternatives while avoiding cumbersome feature engineering, thus streamlining the adoption of DL solutions for traffic analysis.