Respond to Change with Constancy: Instruction-tuning with LLM for Non-I.I.D. Network Traffic Classification

2025-05-27

AI Summary

To address the generalization bottleneck of encrypted traffic classification under non-i.i.d. conditions—specifically, distribution shift induced by the closed-world assumption and severe scarcity of labeled data—this paper proposes an instruction-tuning framework that explicitly incorporates network traffic structural priors. We introduce the first cross-modal instruction-tuning paradigm bridging traffic and text modalities, design ETooL, a self-supervised traffic representation model, and construct NETD, a benchmark dataset supporting dynamic distribution shift evaluation. Our method requires no task-specific annotations and enables zero-shot transfer. On out-of-distribution (OOD) tasks—including APP53 and ISCX-Botnet—it achieves up to 18.17% F1-score improvement; under in-distribution (IID) settings, it attains over 93% accuracy. The approach significantly enhances generalization, robustness against distribution shifts, and annotation efficiency.

Technology Category

• Natural Language Processing: Safety and Robustness
• Machine Learning: Privacy
• Search and Optimization: Distributed Search

Application Category

• Security and Privacy: Large-scale security measurements
• Responsible Web: Data and user privacy-enhancing technologies for the Web
• Economics, Online Markets and Human Computation: Humans versus LLMs for data annotation and labeling

Abstract

Encrypted traffic classification is highly challenging in network security due to the need for extracting robust features from content-agnostic traffic data. Existing approaches face critical issues: (i) Distribution drift, caused by reliance on the closedworld assumption, limits adaptability to realworld, shifting patterns; (ii) Dependence on labeled data restricts applicability where such data is scarce or unavailable. Large language models (LLMs) have demonstrated remarkable potential in offering generalizable solutions across a wide range of tasks, achieving notable success in various specialized fields. However, their effectiveness in traffic analysis remains constrained by challenges in adapting to the unique requirements of the traffic domain. In this paper, we introduce a novel traffic representation model named Encrypted Traffic Out-of-Distribution Instruction Tuning with LLM (ETooL), which integrates LLMs with knowledge of traffic structures through a self-supervised instruction tuning paradigm. This framework establishes connections between textual information and traffic interactions. ETooL demonstrates more robust classification performance and superior generalization in both supervised and zero-shot traffic classification tasks. Notably, it achieves significant improvements in F1 scores: APP53 (I.I.D.) to 93.19%(6.62%) and 92.11%(4.19%), APP53 (O.O.D.) to 74.88%(18.17%) and 72.13%(15.15%), and ISCX-Botnet (O.O.D.) to 95.03%(9.16%) and 81.95%(12.08%). Additionally, we construct NETD, a traffic dataset designed to support dynamic distributional shifts, and use it to validate ETooL's effectiveness under varying distributional conditions. Furthermore, we evaluate the efficiency gains achieved through ETooL's instruction tuning approach.

Problem

• Classifying encrypted traffic with non-I.I.D. distribution shifts
• Overcoming reliance on labeled data for traffic classification
• Adapting LLMs to traffic domain's unique structural requirements

Innovation

• LLM-based instruction tuning for traffic classification
• Self-supervised paradigm integrating traffic structure knowledge
• Dynamic dataset NETD for distribution shift validation