TrafficGPT: Breaking the Token Barrier for Efficient Long Traffic Analysis and Generation

TL;DR

TrafficGPT tackles the token-length and data-labeling bottlenecks in network traffic analysis and generation by combining generative pre-training with a linear attention Transformer, extending context to $12{,}032$ tokens and employing a reversible token representation for exact pcap reconstruction. The model demonstrates state-of-the-art flow classification and realistic traffic generation, achieving a Macro F1 improvement over prior methods and low Jensen-Shannon divergence in generated headers and flow features, along with a discriminative accuracy near random guessing, indicating high realism. The work also provides a thorough evaluation against other linear-complexity transformers, illustrating the practical benefits and remaining challenges in long-context traffic tasks. These results suggest that scalable, long-context traffic models can enhance realistic traffic synthesis and robust classification, with implications for security testing, protocol research, and network optimization.

Abstract

Over the years, network traffic analysis and generation have advanced significantly. From traditional statistical methods, the field has progressed to sophisticated deep learning techniques. This progress has improved the ability to detect complex patterns and security threats, as well as to test and optimize network performance. However, obstacles persist, such as the dependence on labeled data for analysis and the difficulty of generating traffic samples that follow realistic patterns. Pre-trained deep neural networks have emerged as powerful tools to resolve these issues, offering improved performance by learning robust data representations from large unlabeled datasets. Despite their benefits, existing pre-trained models face challenges like token length limitation, which restricts their usefulness in comprehensive traffic analysis and realistic traffic generation. To address these challenges, we introduce TrafficGPT, a deep learning model that can tackle complex challenges related to long flow classification and generation tasks. This model uses generative pre-training with the linear attention mechanism, which allows for a substantially increased capacity of up to 12,032 tokens from the previous limit of only 512 tokens. TrafficGPT demonstrates superior performance in classification tasks, reaching state-of-the-art levels. In generation tasks, it closely resembles real traffic flows, with low JS divergence and an F1 score close to 0.5 (representing a random guess) in discriminating generated data. These advancements hold promise for future applications in both traffic flow classification and generation tasks.

Figures (6)

• Figure 1: The framework of TrafficGPT.
• Figure 2: The structure of flow tokens.
• Figure 3: Variation of Macro F1-Scores with token length using TrafficGPT(12k) fine-tuning in classification.
• Figure 4: The flows generated by TrafficGPT(12k).
• Figure 5: CDF plots of packet headers generated by TrafficGPT(12k).