SNAKE: A Sustainable and Multi-functional Traffic Analysis System utilizing Specialized Large-Scale Models with a Mixture of Experts Architecture

TL;DR

SNAKE tackles the challenge of scalable, multi-attribute network traffic classification in evolving and encrypted environments by employing a multi-gate mixture of experts (MMoE) framework. It interfaces pre-trained expert sub-models, gates, and tower classifiers to enable rapid model fusion and incremental knowledge expansion across diverse tasks such as application type, VPN/Tor usage, and malicious behavior detection, while maintaining task isolation to prevent interference. The paper provides mathematical convergence guarantees for incremental knowledge scenarios and validates performance across eight tasks on five public datasets, showing high accuracy and competitive fusion performance compared to independent models. Limitations include architectural efficiency and the need to explore token-based, multi-stream recognition to fully exploit large pre-trained models; future work envisions a three-layer architecture and broader task integration to yield a universal, sustainable traffic-analysis model with practical impact for security and management.

Abstract

The rapid advancement of internet technology has led to a surge in data transmission, making network traffic classification crucial for security and management. However, there are significant deficiencies in its efficiency for handling multiattribute analysis and its ability to expand model knowledge, making it difficult to adapt to the ever-changing network environment and complex identification requirements. To address this issue, we proposed the SNAKE (Sustainable Network Analysis with Knowledge Exploration) system, which adopts a multi-gated mixture of experts architecture to construct a multi-functional traffic classification model. The system analyzes traffic attributes at different levels through multiple expert sub-models, providing predictions for these attributes via gating and a final Tower network. Additionally, through an intelligent gating configuration, the system enables extremely fast model integration and evolution across various knowledge expansion scenarios. Its excellent compatibility allows it to continuously evolve into a multi-functional largescale model in the field of traffic analysis. Our experimental results demonstrate that the SNAKE system exhibits remarkable scalability when faced with incremental challenges in diverse traffic classification tasks. Currently, we have integrated multiple models into the system, enabling it to classify a wide range of attributes, such as encapsulation usage, application types and numerous malicious behaviors. We believe that SNAKE can pioneeringly create a sustainable and multifunctional large-scale model in the field of network traffic analysis after continuous expansion.

Figures (12)

• Figure 1: Challenges in Existing Network Traffic Analysis Systems This diagram illustrates two key deficiencies in current network traffic analysis systems that lead to low timeliness. On the right, the need for diverse classified intelligence requires repetitive processing of traffic samples through multiple models, resulting in inefficiency. On the left, newly emerging sample sets struggle to be quickly integrated or incrementally updated in trained models, further degrading model timeliness.
• Figure 2: Overview of the SNAKE System Structure The SNAKE system is designed to efficiently aggregate various network traffic classification models. It comprises expert sub-models from pre-trained models in different domains, a concatenation layer that combines their inputs, gates that control the flow of information, and tower layers for specific tasks. This system can continuously integrate new task models, enabling rapid classification of multiple network traffic attributes.
• Figure 3: Examples of Task and Label Domains This figure illustrates the examples of corresponding task domains and label domains, along with the relationships between them.
• Figure 4: Model Extension Performance in Three Incremental Knowledge Scenarios
• Figure 5: Model extension performance in Scenarios 5.3.1