🤖 AI Summary
This study introduces JEPA-style predictive learning to network traffic fingerprinting for the first time, addressing the challenge of learning generalizable representations under incomplete views across heterogeneous data sources. To this end, the authors propose JA4-JEPA, a Transformer-based model that leverages JA4-derived subfields—JA4, HA4H, JA4S, and JA4X—for self-supervised training. The model learns robust embeddings by enforcing consistency between predicted latent representations and outputs from a target encoder. Evaluated on 39,416 held-out samples, JA4-JEPA achieves a cosine similarity of 0.9899 and a kNN classification accuracy of 0.9220, demonstrating its capacity to extract high-quality network fingerprint representations even when input views are partially missing.
📝 Abstract
I-JEPA and V-JEPA learn by matching latent predictions to target encoder outputs rather than regenerating the original input, and this has worked well for images and video. We explore whether the same objective works for compact network fingerprints. We built JA4-JEPA, a Transformer-based model trained on JA4, JA4H, JA4S, and JA4X subfields drawn from JA4DB and CIC-IDS- 2017. The training data combines roughly 397K samples from both sources, though no single sample contains all four view families. We evaluated the learned representations with a frozen kNN probe on protocol-family classification across TLS, DNS, and SSH. On 39,416 heldout samples the model achieved a cosine similarity of 0.9899 and a kNN accuracy of 0.9220. These results indicate that JEPA-style predictive learning can produce useful embeddings from JA4-derived fingerprints, even with incomplete view overlap across sources.
Keywords: JA4, network fingerprinting, JEPA, predictive representation learning, self-supervised learning