With the rise of encrypted and heterogeneous network traffic, label-efficient flow classification has become critical for effective network monitoring. Traditional methods require extensive labeled data and often fail to generalize across networks due to domain shift. To address these challenges, we propose a transfer active learning framework that incorporates labeled training data from a source network data into active learning on the target network. We conduct an evaluation on both protocol and application-type classification tasks across four network datasets, and we demonstrate that – with only 100 expert labels on the target network – our framework yields improvements of 0.43/0.45 macro F1 over classifiers based on the source network. Also, our approach – which utilizes clustering for efficient annotation – outperforms active learning only on the target network by 0.08, and active learning on individual samples without clustering by 0.18 for protocol classification. These results demonstrate that our framework provides a practical, scalable, and label-efficient solution for adaptable network traffic analysis.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

From One Network to Another: Transfer Active Learning for Domain Adaptation of Flow Classifiers

  • Maurice Falk,
  • Alexander Prange,
  • Adrian Ulges

摘要

With the rise of encrypted and heterogeneous network traffic, label-efficient flow classification has become critical for effective network monitoring. Traditional methods require extensive labeled data and often fail to generalize across networks due to domain shift. To address these challenges, we propose a transfer active learning framework that incorporates labeled training data from a source network data into active learning on the target network. We conduct an evaluation on both protocol and application-type classification tasks across four network datasets, and we demonstrate that – with only 100 expert labels on the target network – our framework yields improvements of 0.43/0.45 macro F1 over classifiers based on the source network. Also, our approach – which utilizes clustering for efficient annotation – outperforms active learning only on the target network by 0.08, and active learning on individual samples without clustering by 0.18 for protocol classification. These results demonstrate that our framework provides a practical, scalable, and label-efficient solution for adaptable network traffic analysis.