ECODI: a novel evolutionary coreset distillation with LLM-assisted fitness evaluation for encrypted network traffics
摘要
Nowadays, machine learning-based methods have become essential for classifying network data flows under encryption, as traditional deep packet inspection is ineffective due to encryption protocols like HTTPS and QUIC, which now cover over 85% of Internet traffic. However, the scale of modern Internet traffic introduces new challenges, particularly the massive size of datasets required for training these models. Handling such large datasets results in excessive computational costs, prompting the need for data condensation techniques that reduce dataset size without sacrificing performance. In this paper, we propose a novel Evolutionary Coreset Distillation method for network traffic classification. Our approach, named ECODI, combines the power of evolutionary algorithms with Large Language Models (LLMs) to condense large datasets into smaller, representative coresets. We employ LLMs to generate high-level embeddings that guide the evolutionary algorithm in selecting coresets, thus preserving the most important information while reducing the dataset size. Additionally, we introduce a gradient-based forgetting mechanism to further refine the coreset by eliminating redundant or low-impact data points. The extensive experiments demonstrate that ECODI outperforms both traditional methods (Random Sampling, K-Center, and Herding) and recent evolutionary approaches (EVA and DEvS) in achieving high classification performance with reduced dataset sizes. Notably, ECODI achieves a fitness score of 0.94 in as few as 10 generations, offering substantial improvements in terms of both convergence speed and final classification accuracy compared to EVA and DEvS.