This work proposes a novel training-free few-shot network traffic classification framework based on large language models based on large language models (LLMs) that reduces reliance on labeled data, eliminates task-specific training, and improves performance.
Abstract
Encrypted web traffic and evolving Internet technologies pose an increasing challenge to network traffic analysis. However, existing traffic classification methods, though effective, require large labeled datasets and complex training. This makes sustaining them prohibitively expensive and difficult in real-world scenarios. To narrow this gap, we propose a novel training-free few-shot network traffic classification framework based on large language models (LLMs). By integrating meta-learning with LLMs, it reduces reliance on labeled data, eliminates task-specific training, and improves performance. Specifically, we first apply an efficient feature extraction method to extract features from traffic flows. We then design meta-tasks that combine task descriptions with textualized features to produce natural language meta-task formulations. Building on these meta-tasks, the LLM performs reasoning to carry out traffic classification. Finally, to mitigate hallucination in the LLM outputs, we exploit the temporal characteristics of network traffic and aggregate predictions over samples within a defined time window. Extensive experiments on three widely-used encrypted traffic datasets demonstrate that our proposed framework outperforms the state-of-the-art methods, achieving an average absolute improvement in F1 score of 9.75, 9.82, and 12.06 percentage points on the three datasets, respectively.
Attacks against networks keep changing form, and Intrusion Detection Systems (IDS) still stand among the first defenses expected to catch them. Deep learning brought real gains in detection accuracy, but a habit persists across most published models: traffic enters as flat tabular records, and whatever context ties one attribute to another is thrown away before training begins. This work follows a different route. Every network record is rewritten as a short piece of text - the protocol, the connection state, the ports, and a few traffic statistics, joined into what we call a semantic flow - after which the sequence is tokenized, embedded, and handed to a small Convolutional Neural Network (CNN). No transformer appears anywhere in the pipeline, and no recurrent stack either; the representation itself does the heavy lifting. Four benchmark datasets served for the evaluation (CIC-IDS-2017, KDDCup99, NSL-KDD, and Hogzilla), in binary as well as multiclass settings. Accuracy fell between 99.04% and 99.95%, F1-scores held above 0.99, and AUC values remained high - figures we read with prudence, since they come from benchmark data alone. Even so, one lesson emerges from the experiments: putting the effort into how traffic is written down, instead of making the classifier heavier, offers an economical and workable path to intrusion detection across heterogeneous network environments.
Asmaa Benchama, Khalid Zebbara· EPJ Web of Conferences· 0 citations
This work proposes distilling the model into a probabilistic classifier, enabling lightweight deployment without repeated LLM calls, and demonstrates that LSR improves macro-F1 scores by an average of 7.0% compared to standard zero-shot classification baselines.
Nathan Vandemoortele, Bram Steenwinckel, F. Ongenae et al.· Discover Computing· 0 citations
Overall, LLMs offer a flexible and annotation-light alternative to traditional fine-tuning, but their successful deployment in finance will depend on robust prompt engineering and solid factual grounding.
Liyang Gao· Applied and Computational En...· 0 citations
This paper introduces Gradient Enhancement Task Aware Post-training Quantization, i.e., GTAQ, to address the generalization issue of Large Language Models, and extensively evaluates the LLaMA family of language models on WikiText, C4, and MMLU.
Yihua Shao, Yangyang Gu, Minxi Yan et al.· 0 citations
Early time-series classification (ETSC) aims to make accurate predictions from partially observed time series as early as possible. Although various stopping mechanisms and feature learning strategies have been developed for ETSC, most existing methods assume access to sufficient labeled training data, which may be unrealistic in applications with limited annotation. Under limited supervision, learning an additional sample-level stopping module and extracting effective classification features can both become challenging. In this paper, we propose FETERS, a few-shot ETSC framework that selects a dataset-level stopping ratio through class-wise leave-one-out (LOO) evaluation on the support set and uses a penalty-based reward function to manage the accuracy-earliness trade-off, thereby avoiding the need to train an additional stopping module. FETERS further combines Rocket-based features with frozen Chronos representations for classification. Extensive experiments on 69 public datasets spanning 14 domains show that FETERS achieves state-of-the-art (SOTA) performance in the 5-shot setting, with the highest average harmonic mean (HM) and the best HM on 38 datasets, while outperforming the current SOTA method on 44 datasets. FETERS also remains competitive in the full-shot setting, demonstrating its effectiveness in managing the accuracy-earliness trade-off.
Chen-An Tai, Yujia Wu, Vincent S. Tseng· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
