TraGe: A Generic Packet Representation for Traffic Classification Based on Header-Payload Differences

TL;DR

TraGe introduces a novel packet representation model that leverages header-payload differences and dynamic masking to improve traffic classification accuracy and robustness with limited labeled data.

Contribution

It presents a new pre-training approach tailored for network traffic data, addressing limitations of image/text-based models and enhancing classification performance.

Findings

Outperforms state-of-the-art methods by up to 6.97%

Demonstrates robustness under parameter fluctuations

Effective with limited labeled data

Abstract

Traffic classification has a significant impact on maintaining the Quality of Service (QoS) of the network. Since traditional methods heavily rely on feature extraction and large scale labeled data, some recent pre-trained models manage to reduce the dependency by utilizing different pre-training tasks to train generic representations for network packets. However, existing pre-trained models typically adopt pre-training tasks developed for image or text data, which are not tailored to traffic data. As a result, the obtained traffic representations fail to fully reflect the information contained in the traffic, and may even disrupt the protocol information. To address this, we propose TraGe, a novel generic packet representation model for traffic classification. Based on the differences between the header and payload-the two fundamental components of a network packet-we perform differentiated pre-training according to the byte sequence variations (continuous in the header vs. discontinuous in the payload). A dynamic masking strategy is further introduced to prevent overfitting to fixed byte positions. Once the generic packet representation is obtained, TraGe can be finetuned for diverse traffic classification tasks using limited labeled data. Experimental results demonstrate that TraGe significantly outperforms state-of-the-art methods on two traffic classification tasks, with up to a 6.97% performance improvement. Moreover, TraGe exhibits superior robustness under parameter fluctuations and variations in sampling configurations.