Pith. sign in

REVIEW 4 major objections 5 minor 90 references

NetFlowGen: Leveraging Generative Pre-training for Network Traffic Dynamics

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read NetFlowGen shows that generative pre-training on unlabeled NetFlow records, followed by fine-tuning on only 360 labeled examples, matches DDoS detectors trained on 1,606 examples.

desk verdict NetFlowGen is a plausible early application of GPT-style pre-training to flow-level NetFlow data, but its sample-efficiency claim rests on a single comparison over a filtered 7.5% of IPs and lacks uncertainty quantification. read the letter →

arxiv 2412.20635 v1 pith:JMIRRUYH submitted 2024-12-30 cs.LG cs.AIcs.NI

Jiawei Zhou , Woojeong Kim , Zhiying Xu , Alexander M. Rush , Minlan Yu This is my paper · ORCID
classification cs.LGcs.AIcs.NI
keywords networktrafficpre-trainingNetFlowDDoSearlydetectionTransformerdecoderself-supervisedlearningdynamicssample-efficientfine-tuningfoundationmodelfornetworking
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

NetFlowGen is an early attempt to build a general-purpose network-traffic model by generative pre-training: a Transformer decoder is trained, with no labels, to predict the next minute of 86 traffic features from unlabeled NetFlow records collected over three months at an ISP. The claim is that this pre-training captures enough about traffic dynamics that a frozen backbone plus a small classification head can detect DDoS attacks with F1=0.96 using only 360 labeled examples, matching a from-scratch Transformer and a multiscale LSTM trained on 1,606 examples. If true, the expensive, expert-labeling bottleneck for networking ML can be partly bypassed by exploiting the abundant unlabeled traffic already collected at ISPs. The paper also shows the same recipe transfers across attack types and to IP nodes never seen in pre-training.

What carries the argument

The load-bearing object is a small decoder-only Transformer (4 layers, 4 heads, hidden size 128, about 1.9 million parameters) fed by a unified feature-representation pipeline. Continuous traffic and time features are discretized per node and per feature into 10 bins using a quantile binning algorithm, then one-hot encoded and linearly projected; categorical metadata such as node ID and customer ID are embedded and added. The model's pre-training loss is $\frac{1}{VT|\mathcal{F}|}\sum_{v,t,f} -\log p_\theta(y^v_{f,t} \mid \mathbf{y}^v_{<t}, v)$, meaning next-step prediction over all 86 features for all nodes, which makes the model learn both temporal dynamics and feature interactions. At fine-tuning time a small feedforward head on the frozen hidden representation predicts non-increasing survival probabilities under the SAFE loss, converting the generative model into an early DDoS detector. This pipeline is what lets the same backbone transfer to DDoS detection with a small label budget.

What would settle it

Re-run the same 360-label fine-tuning after pre-training on the unfiltered ISP corpus, including the dominant customer and its associates; if the F1 advantage over the 1,606-example baselines disappears or drops below parity, the exclusion was load-bearing.

Watch

Extended reading notes

Core claim

On its own terms, the paper's discovery is that a decoder-only Transformer, pre-trained with the next-step prediction objective on unlabeled, per-IP multivariate time series of NetFlow features, learns transferable traffic dynamics. Each IP node is treated as a task; at every minute the model predicts all 86 discretized features, including packet, byte, and flow counts by protocol, port class, and TCP flag, plus time features, from the node's history. The pre-trained backbone is frozen and a 67K-parameter classification head is fine-tuned with the SAFE survival loss on the Xatu early-detection setup. With 360 labeled examples it reaches 100% effectiveness, 0.06 overhead, FNR 5.42%, FPR 3.45%, and F1 0.96, comparable to or better than Transformer and Multiscale-LSTM baselines trained on 1,606 examples. It also detects rare DNS attacks using only 13 labeled DNS examples in the fine-tuning set, accurately handling 203 test attacks, and classifies all 432 unseen-node test examples as non-attacks.

Load-bearing premise

The argument depends on the filtered pre-training corpus, which excludes the dominant customer and its associates and thereby removes about 92% of customer IP addresses, still being representative enough that the measured sample-efficiency gains would survive on unexcluded, real ISP-scale traffic.

Editorial extensions

If this is right

  • A network operator can fine-tune a pre-trained traffic model for DDoS early detection with roughly 22% of the labels a from-scratch model needs and still match its F1 score (0.96 versus 0.95 to 0.96).
  • Because the backbone is frozen during fine-tuning, adapting to a new attack type only trains a small classification head, making per-task deployment cheap.
  • Attack types with very few labeled examples, such as DNS amplification with 13 instances, can still be detected accurately at test time, suggesting the pre-trained representation carries the relevant signatures.
  • Unseen IP nodes can be handled by mapping them through nearest-neighbor search to the most similar pre-training node, and in the tested setting this yields perfect non-attack classification.
  • Using the full 86-feature set improves FPR and F1 over a 6-feature volume-only model, so feature diversity during pre-training is part of what makes the transfer work.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the filtering of the dominant customer really is load-bearing, then a fair test of the framework at ISP scale would need either unfiltered pre-training data or a demonstration that the excluded traffic is learnable; this is an editorial extension, not a paper claim.
  • The paper's per-node isolation means inter-node structure, who talks to whom, is never modeled; a graph-aware pre-training objective could plausibly unlock P2P identification and protocol-reverse-engineering tasks the paper lists as future work.
  • One-minute aggregation and 10-bin discretization discard timing and magnitude detail; extending the objective to continuous or irregular-time traffic could improve tasks sensitive to microbursts or sub-minute attack ramps.
  • The near-flat scaling results across model sizes suggest traffic pre-training may not follow NLP scaling laws in this regime; a direct scaling study with larger corpora and models would test whether bigger traffic foundation models actually pay off.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. NetFlowGen proposes a decoder-only Transformer pre-trained on unlabeled ISP NetFlow records to predict next-minute traffic features, then frozen and fine-tuned with a lightweight classification head for DDoS early detection. The paper contributes a feature discretization and embedding pipeline that handles 86 heterogeneous traffic features, a real ISP dataset for pre-training, and an EarlyDetect benchmark built on the Xatu task. The central empirical claim is that with 360 labeled examples, NetFlowGen reaches F1=0.96, matching or beating from-scratch Transformer and Multiscale-LSTM models trained on 1,606 examples (Table 5).

Significance. If the sample-efficiency claim holds, this is a useful step toward network foundation models and would reduce the labeling burden for network security tasks. The paper has several genuine strengths: it uses real ISP NetFlow data rather than synthetic traces, it unifies a broad set of 86 traffic features through a simple binning and embedding scheme, it keeps the backbone frozen during fine-tuning, and it evaluates on a realistic DDoS early-detection task with the Xatu effectiveness/overhead metrics. However, the current evaluation does not yet establish the headline claim: the main comparison is measured only on a heavily filtered subset of the data, the training splits differ between the pre-trained model and the baselines, the per-attack-type results are mixed, and no uncertainty quantification is reported. The central idea is defensible, but the load-bearing empirical evidence needs substantial rework.

major comments (4)
  1. [Section 4.2 / Table 1] The filtering step removes the dominant customer and associated customers, discarding about 92% of customer IPs, and all subsequent pre-training and fine-tuning use only the remaining 520 nodes. The paper provides no characterization of how the retained traffic compares with the excluded traffic in volume, attack diversity, or baseline difficulty. Since the headline 360-vs-1,606 sample-efficiency result in Table 5 is measured only on this pruned population, the measured gain may be an artifact of a quieter, more stereotyped subset rather than a transferable property of the pre-training method. Please either run the main comparison on the full data or on a representative sample that includes the dominant customer, or provide quantitative evidence that the filtered subset preserves the difficulty and diversity of the original traffic. Section 9 discusses discretization and missing node interactions but does not address this representativeness issue.
  2. [Section 5.1 / Section 6.2 / Table 5] Fine-tuning for NetFlowGen is performed on the EarlyDetect validation split (360 examples), while the 'MoreData' baselines are trained on the train split (1,606 examples), so the comparison conflates the effect of pre-training with a difference in data provenance. It is also not explicitly stated whether the 360-example baseline runs use the same validation split as NetFlowGen or a 360-example subset of the train split. Please retrain all baselines on exactly the same split and the same number of examples as NetFlowGen, and report multiple seeds with means and standard deviations. Without error bars or significance testing, the differences among F1=0.96 for NetFlowGen and 0.95/0.96 for the from-scratch models in Table 5 are not distinguishable from noise.
  3. [Section 6.2 / Table 6] The per-attack-type results do not uniformly support the sample-efficiency claim. On UDP attacks, Multiscale-LSTM with 360 labels achieves F1=0.94 while NetFlowGen achieves 0.80, and on NTP attacks the plain Transformer achieves F1=0.98 versus 0.95 for NetFlowGen. The text claims better generalization 'across all attack types' based only on effectiveness, but F1 and FPR paint a different picture. Please report the per-type comparison under the same training-split protocol and discuss why the aggregate F1 advantage does not persist for UDP and NTP.
  4. [Section 7.1 / Table 8] The unseen-node generalization experiment contains no attack examples in the test set: all 432 examples are true negatives, with zero true positives and zero false negatives. This shows only that the model rarely flags low-volume non-attack traffic; it provides no evidence that NetFlowGen can detect DDoS attacks on nodes that were unseen during pre-training. Please evaluate unseen nodes with attack labels, or state explicitly that only non-attack generalization was tested and limit the corresponding claims accordingly.
minor comments (5)
  1. [Section 6.1 / Table 4] The bigram baseline is described as strong because most features remain constant, but the comparison reports only point estimates (PPL 1.20 vs 1.23, accuracy 0.94 vs 0.93) with no confidence intervals or per-feature/node breakdown; the sanity check would be more convincing with such a breakdown.
  2. [Section 3.1 / Algorithm 1] Algorithm 1 has inconsistent notation: the input is written as {x^v_f}^T_{t=1} but the sorted sequence is indexed with parentheses, and the update to c'_{j+1} inside the loop is not clearly defined after the first refinement. Please rewrite the pseudocode with consistent indices and explicit loop invariants.
  3. [Section 9 / Table 1] The text says the pre-training dataset is 'about one million minutes,' but Table 1 reports a filtered training size of 96,720 and a raw training size of 1,297,350; please clarify the unit (node-minutes vs minutes) and reconcile the numbers.
  4. [Section 4.2 / Table 1] Table 1 does not state the unit of 'Training Size' and 'Validation Size' (node-minutes, examples, or something else); please specify the unit in the caption.
  5. [Section 7.3 / Table 10] The model-size ablation reports pre-training loss, accuracy, and perplexity but no downstream fine-tuning results, so the statement that the smallest model 'already achieves good performance' is only partially supported; please clarify or add fine-tuning results for the larger configurations.

Circularity Check

0 steps flagged · score 2.0 of 10

No material circularity: the pre-training advantage is measured against independent baselines on held-out DDoS data; self-citations are contextual, not load-bearing.

full rationale

The paper's derivation chain is self-contained. The pre-training objective in Eq. (1) is standard autoregressive next-step prediction over 86 discretized traffic features, and the downstream DDoS detection benchmark (EarlyDetect) has separate labeled splits: the model is fine-tuned on the 360-example validation split and evaluated on a held-out test set containing 203 attacks. The comparison against randomly initialized Transformer and Multiscale-LSTM baselines uses the same input features, history length, and SAFE loss, so the headline sample-efficiency result (360 labels, F1=0.96 vs. 1,606 labels, F1=0.95-0.96) is an empirical comparison rather than a quantity defined by its inputs. The per-node per-feature discretization bins are fitted on unlabeled traffic, but attack labels and onsets come from external DDoS alerts and CUSUM, not from the model, so no prediction is forced by construction. The paper cites Xatu [78], which shares authors, for the task setup, effectiveness/overhead metrics, and the Multiscale-LSTM baseline; this is a minor self-citation but not load-bearing, since the central claim is judged against those baselines on held-out data and does not reduce to Xatu's conclusions. Other self-citations (e.g., [17, 23, 42, 43, 88, 89]) are contextual. Two external-validity risks are worth noting but are not circularity: Section 4.2 discards the dominant customer and about 92% of customer IPs, so the benchmark population is a filtered subset, and Section 4.1 pre-trains on the same time span later used for downstream test evaluation, which could make the evaluation optimistic. These concern whether the measured gain generalizes, not whether the derivation reduces to its own inputs.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on several data-dependent choices: per-node quantile discretization, exclusion of 92% of IPs, alert-based labels, and unstated threshold selection. These are not derived from first principles and are fit to the training data.

free parameters (4)
  • Discretization bin count N = 10
    Algorithm 1 quantizes each continuous traffic feature per node into 10 bins (1 zero bin plus 9 quantile bins); chosen by hand and affects the granularity of all pre-training and downstream inputs.
  • Per-node, per-feature bin cutoff points = Quantile-based cutoffs per node and feature, computed on pre-training data
    The bin boundaries are fitted to each node's training traffic (Section 3.1, Algorithm 1) and applied to validation and test. For unseen nodes, boundaries are transferred from the nearest training node (Section 7.1). This data-dependent transformation is load-bearing for the model's predictions.
  • Detection threshold tau = Not reported
    The SAFE loss fine-tuning detects an attack when survival probability s_t < tau (Section 3.2). The threshold selection is not described, so it is a hidden free parameter in the evaluation.
  • Overhead bound = 80% (and 75%, 85% in Figure 5)
    Effectiveness is evaluated at a chosen overhead bound, and results change with this choice, making it an evaluation free parameter.
assumptions (5)
  • standard math Transformer decoders with autoregressive training learn useful representations for time series
    The paper assumes GPT-style next-step prediction transfers to multivariate traffic features (Section 3.1).
  • domain assumption One-minute aggregation preserves traffic dynamics relevant to attacks
    Traffic is aggregated to fixed one-minute steps (Section 3.1), ignoring sub-minute dynamics.
  • ad hoc to paper The filtered ISP NetFlow dataset is representative of general network traffic
    Section 4.2 excludes a dominant customer and associated customers, removing 92% of IPs, to 'ensure generalizability'; this assumption is load-bearing for the generality of the result.
  • domain assumption Commercial DDoS defense alerts, after filtering, provide accurate ground truth
    Downstream labels come from 16K alerts from a commercial defense system, with false-positive and mismatch filtering (Section 4.2).
  • domain assumption The validation split can serve as fine-tuning data without biasing evaluation
    NetFlowGen is fine-tuned on the EarlyDetect validation set (Section 5.1) while baselines use the train set; this assumes the splits are comparable.

how reviews work

0 comments
Cite this review

Pith. "Pith review of NetFlowGen: Leveraging Generative Pre-training for Network Traffic Dynamics." pith.science (2026). https://pith.science/paper/JMIRRUYH

@misc{pith2026241220635,
  author       = {Pith},
  title        = {Pith review of: NetFlowGen: Leveraging Generative Pre-training for Network Traffic Dynamics},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JMIRRUYH}},
  note         = {Machine review of arXiv:2412.20635}
}
read the original abstract

Understanding the traffic dynamics in networks is a core capability for automated systems to monitor and analyze networking behaviors, reducing expensive human efforts and economic risks through tasks such as traffic classification, congestion prediction, and attack detection. However, it is still challenging to accurately model network traffic with machine learning approaches in an efficient and broadly applicable manner. Task-specific models trained from scratch are used for different networking applications, which limits the efficiency of model development and generalization of model deployment. Furthermore, while networking data is abundant, high-quality task-specific labels are often insufficient for training individual models. Large-scale self-supervised learning on unlabeled data provides a natural pathway for tackling these challenges. We propose to pre-train a general-purpose machine learning model to capture traffic dynamics with only traffic data from NetFlow records, with the goal of fine-tuning for different downstream tasks with small amount of labels. Our presented NetFlowGen framework goes beyond a proof-of-concept for network traffic pre-training and addresses specific challenges such as unifying network feature representations, learning from large unlabeled traffic data volume, and testing on real downstream tasks in DDoS attack detection. Experiments demonstrate promising results of our pre-training framework on capturing traffic dynamics and adapting to different networking tasks.

Figures

Figures reproduced from arXiv: 2412.20635 by the authors.

Figure 1
Figure 1. A desirable vision of a network foundation model that captures comprehensive traffic dynamics and [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. NetFlowGen generative pre-training framework. The framework consists of two parts: generative [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Feature representation process of NetFlowGen. We employ two different embedding methods. For [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: An example UDP attack describing the effectiveness and overhead metrics. A: anomalous traffic; B: [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Effectiveness and absolute mitigation time under three different overhead bounds [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

90 extracted references · 58 canonical work pages

  1. [1]

    Soheil Abbasloo, Chen-Yu Yen, and H Jonathan Chao. 2020. Classic meets modern: A pragmatic learning-based congestion control for the internet. In Proceedings of the Annual conference of the ACM Special Interest Group on Data Communication on the applications, technologies, architectures, and protocols for computer communication . 632–647

    2020

  2. [2]

    June-ho Bang, Young-Jong Cho, and Kyungran Kang. 2017. Anomaly Detection of Network-initiated LTE Signaling Traffic in Wireless Sensor and Actuator Networks based on a Hidden Semi-Markov Model. Computers & Security 65 (2017), 108–120

    2017

  3. [3]

    Yoshua Bengio, Réjean Ducharme, and Pascal Vincent. 2000. A neural probabilistic language model. Advances in neural information processing systems 13 (2000)

    2000

  4. [4]

    Przemysław Bereziński, Bartosz Jasiul, and Marcin Szpyrka. 2015. An Entropy-based Network Anomaly Detection Method. Entropy 17, 4 (2015), 2367–2408

    2015

  5. [5]

    Rishi Bommasani, Drew A Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, et al. 2021. On the opportunities and risks of foundation models. arXiv preprint arXiv:2108.07258 (2021)

    arXiv 2021

  6. [6]

    Raouf Boutaba, Mohammad A Salahuddin, Noura Limam, Sara Ayoubi, Nashid Shahriar, Felipe Estrada-Solano, and Oscar M Caicedo. 2018. A comprehensive survey on machine learning for networking: evolution, applications and research opportunities. Journal of Internet Services and Applications 9, 1 (2018), 1–99

    2018

  7. [7]

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language models are few-shot learners. Advances in neural information processing systems 33 (2020), 1877–1901

    2020

  8. [8]

    Christian Callegari, Stefano Giordano, Michele Pagano, and Teresa Pepe. 2011. Combining Sketches and Wavelet Analysis for Multi Time-scale Network Anomaly Detection. Computers & Security 30, 8 (2011), 692–704

    2011

Show all 90 references
  1. [9]

    Glenn Carl, George Kesidis, Richard R Brooks, and Suresh Rai. 2006. Denial-of-service Attack-detection Techniques. IEEE Internet computing 10, 1 (2006), 82–89

    2006

  2. [10]

    Fran Casino, Kim-Kwang Raymond Choo, and Constantinos Patsakis. 2019. HEDGE: efficient traffic classification of encrypted and compressed packets. IEEE Transactions on Information Forensics and Security 14, 11 (2019), 2916–2926

    2019

  3. [11]

    Li Chen, Justinas Lingys, Kai Chen, and Feng Liu. 2018. Auto: Scaling deep reinforcement learning for datacenter- scale automatic traffic optimization. In Proceedings of the 2018 conference of the ACM special interest group on data 18 Zhou, et al. communication. 191–205

    2018

  4. [12]

    Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebastian Gehrmann, et al. 2022. Palm: Scaling language modeling with pathways. arXiv preprint arXiv:2204.02311 (2022)

    2022 arXiv

  5. [13]

    Benoit Claise. 2004. Cisco systems netflow services export version 9 . Technical Report

    2004

  6. [14]

    Benoit Claise. 2008. Specification of the IP flow information export (IPFIX) protocol for the exchange of IP traffic flow information. Technical Report

    2008

  7. [15]

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2018. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 (2018)

    2018 arXiv

  8. [16]

    Alexander Dietmüller, Siddhant Ray, Romain Jacob, and Laurent Vanbever. 2022. A new hope for network model generalization. In Proceedings of the 21st ACM Workshop on Hot Topics in Networks . 152–159

    2022

  9. [17]

    Jie Ding, Enmao Diao, Jiawei Zhou, and Vahid Tarokh. 2020. On statistical efficiency in learning. IEEE Transactions on Information Theory 67, 4 (2020), 2488–2506

    2020

  10. [18]

    Rohan Doshi, Noah Apthorpe, and Nick Feamster. 2018. Machine learning DDoS Detection for Consumer Internet of Things Devices. In IEEE Security and Privacy Workshops . 29–35

    2018

  11. [19]

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. 2020. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint...

    2020 arXiv

  12. [20]

    Laura Feinstein, Dan Schnackenberg, Ravindra Balupari, and Darrell Kindred. 2003. Statistical Approaches to DDoS Attack Detection and Response. In Proceedings DARPA Information Survivability Conference and Exposition , Vol. 1. IEEE, 303–314

    2003

  13. [21]

    Yunsheng Fu, Fang Lou, Fangzhi Meng, Zhihong Tian, Hua Zhang, and Feng Jiang. 2018. An intelligent network attack detection method based on rnn. In 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC) . IEEE, 483–489

    2018

  14. [22]

    Olivia A Grigg, VT Farewell, and DJ Spiegelhalter. 2003. Use of Risk-adjusted CUSUM and RSPRTcharts for Monitoring in Medical Contexts. Statistical Methods in Medical Research 12, 2 (2003), 147–170

    2003

  15. [23]

    Devaansh Gupta, Siddhant Kharbanda, Jiawei Zhou, Wanhua Li, Hanspeter Pfister, and Donglai Wei. 2023. CLIPTrans: transferring visual knowledge with pre-trained models for multimodal machine translation. In Proceedings of the IEEE/CVF international conference on computer vision...

    2023

  16. [24]

    Mohamed Hamdi and Noureddine Boudriga. 2007. Detecting Denial-of-Service Attacks Using the Wavelet Transform. Computer Communications 30, 16 (2007), 3203–3213

    2007

  17. [25]

    Jordan Hoffmann, Sebastian Borgeaud, Arthur Mensch, Elena Buchatskaya, Trevor Cai, Eliza Rutherford, Diego de Las Casas, Lisa Anne Hendricks, Johannes Welbl, Aidan Clark, et al . 2022. Training compute-optimal large language models. arXiv preprint arXiv:2203.15556 (2022)

    2022 arXiv

  18. [26]

    Seong-Cheol Hong, Jin Kim, Byungchul Park, Young J Won, and James W Hong. 2009. Traffic growth analysis over three years in enterprise networks. In 2009 15th Asia-Pacific Conference on Communications . IEEE, 896–899

    2009

  19. [27]

    Weihua Hu, Bowen Liu, Joseph Gomes, Marinka Zitnik, Percy Liang, Vijay Pande, and Jure Leskovec. 2019. Strategies for pre-training graph neural networks. arXiv preprint arXiv:1905.12265 (2019)

    2019 arXiv

  20. [28]

    Mohamed Idhammad, Karim Afdel, and Mustapha Belouch. 2018. Detection System of HTTP DDoS Attacks in a Cloud Environment based on Information Theoretic Entropy and Random Forest. Security and Communication Networks 2018 (2018)

    2018

  21. [29]

    Marios Iliofotou, Prashanth Pappu, Michalis Faloutsos, Michael Mitzenmacher, Sumeet Singh, and George Varghese

  22. [30]

    Arthur S Jacobs, Roman Beltiukov, Walter Willinger, Ronaldo A Ferreira, Arpit Gupta, and Lisandro Z Granville. 2022. AI/ML for Network Security: The Emperor has no Clothes. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security

    2022

  23. [31]

    Nathan Jay, Noga Rotman, Brighten Godfrey, Michael Schapira, and Aviv Tamar. 2019. A deep reinforcement learning perspective on internet congestion control. In International Conference on Machine Learning . PMLR, 3050–3059

    2019

  24. [32]

    Enamul Kabir, Jiankun Hu, Hua Wang, and Guangping Zhuo. 2018. A Novel Statistical Technique for Intrusion Detection Systems. Future Generation Computer Systems 79 (2018), 303–318

    2018

  25. [33]

    Yoshiki Kanda, Romain Fontugne, Kensuke Fukuda, and Toshiharu Sugawara. 2013. ADMIRE: Anomaly Detection Method Using Entropy-based PCA with Three-step Sketches. Computer Communications 36, 5 (2013), 575–588

    2013

  26. [34]

    Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. 2020. Scaling laws for neural language models. arXiv preprint arXiv:2001.08361 (2020)

    2020 arXiv

  27. [35]

    Amin Karami and Manel Guerrero-Zapata. 2015. A Fuzzy Anomaly Detection System based on Hybrid PSO-Kmeans Algorithm in Content-centric Networks. Neurocomputing 149 (2015), 1253–1269. NetFlowGen: Leveraging Generative Pre-training for Network Traffic Dynamics 19

    2015

  28. [36]

    Amin Kharraz, William Robertson, and Engin Kirda. 2018. Surveylance: Automatically detecting online survey scams. In 2018 IEEE Symposium on Security and Privacy (SP) . IEEE, 70–86

    2018

  29. [37]

    Diederik P Kingma and Jimmy Ba. 2014. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014)

    2014 arXiv

  30. [38]

    Stefan Kornexl, Vern Paxson, Holger Dreger, Anja Feldmann, and Robin Sommer. 2005. Building a time machine for efficient recording and retrieval of high-volume network traffic. In 5th Internet Measurement Conference . USENIX Association, 267–272

    2005

  31. [39]

    Anukool Lakhina, Mark Crovella, and Christophe Diot. 2004. Diagnosing Network-wide Traffic Anomalies. ACM SIGCOMM computer communication review 34, 4 (2004), 219–230

    2004

  32. [40]

    Franck Le, Mudhakar Srivatsa, Raghu Ganti, and Vyas Sekar. 2022. Rethinking data-driven networking with foundation models: challenges and opportunities. In Proceedings of the 21st ACM Workshop on Hot Topics in Networks . 188–197

    2022

  33. [41]

    Mike Lewis, Yinhan Liu, Naman Goyal, Marjan Ghazvininejad, Abdelrahman Mohamed, Omer Levy, Ves Stoyanov, and Luke Zettlemoyer. 2019. Bart: Denoising sequence-to-sequence pre-training for natural language generation, translation, and comprehension. arXiv preprint arXiv:1910.134...

    2019 arXiv

  34. [42]

    Michael Lingzhi Li, Meng Dong, Jiawei Zhou, and Alexander M Rush. 2019. A hierarchy of graph neural networks based on learnable local features. arXiv preprint arXiv:1911.05256 (2019)

    2019 arXiv

  35. [43]

    Wanhua Li, Zibin Meng, Jiawei Zhou, Donglai Wei, Chuang Gan, and Hanspeter Pfister. 2024. SocialGPT: Prompting LLMs for Social Relation Reasoning via Greedy Segment Optimization. In The Thirty-eighth Annual Conference on Neural Information Processing Systems

    2024

  36. [44]

    Eric Liang, Hang Zhu, Xin Jin, and Ion Stoica. 2019. Neural packet classification. In Proceedings of the ACM Special Interest Group on Data Communication . 256–269

    2019

  37. [45]

    Xinjie Lin, Gang Xiong, Gaopeng Gou, Zhen Li, Junzheng Shi, and Jing Yu. 2022. Et-bert: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification. In Proceedings of the ACM Web Conference 2022. 633–642

    2022

  38. [46]

    Jiawei Liu, Cheng Yang, Zhiyuan Lu, Junze Chen, Yibo Li, Mengmei Zhang, Ting Bai, Yuan Fang, Lichao Sun, Philip S Yu, et al. 2023. Towards graph foundation models: A survey and beyond. arXiv preprint arXiv:2310.11829 (2023)

    2023 arXiv

  39. [47]

    Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692 (2019)

    2019 arXiv

  40. [48]

    Renqian Luo, Liai Sun, Yingce Xia, Tao Qin, Sheng Zhang, Hoifung Poon, and Tie-Yan Liu. 2022. BioGPT: generative pre-trained transformer for biomedical text generation and mining. Briefings in Bioinformatics 23, 6 (2022)

    2022

  41. [49]

    Antonis Manousis, Rahul Anand Sharma, Vyas Sekar, and Justine Sherry. 2020. Contention-aware performance prediction for virtualized network functions. In Proceedings of the Annual conference of the ACM Special Interest Group on Data Communication on the applications, technolog...

    2020

  42. [50]

    Xuying Meng, Chungang Lin, Yequan Wang, and Yujun Zhang. 2023. NetGPT: Generative Pretrained Transformer for Network Traffic. arXiv preprint arXiv:2304.09513 (2023)

    2023 arXiv

  43. [51]

    Xuying Meng, Yequan Wang, Runxin Ma, Haitong Luo, Xiang Li, and Yujun Zhang. 2022. Packet representation learning for traffic classification. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 3546–3554

    2022

  44. [52]

    Nisharani Meti, DG Narayan, and VP Baligar. 2017. Detection of Distributed Denial of Service Attacks Using Machine Learning Algorithms in Software-defined Networks. In International conference on advances in computing, communications and informatics. 1366–1371

    2017

  45. [53]

    Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, and Asaf Shabtai. 2018. Kitsune: an ensemble of autoencoders for online network intrusion detection. arXiv preprint arXiv:1802.09089 (2018)

    2018 arXiv

  46. [54]

    Hermann Ney and Ute Essen. 1991. On smoothing techniques for bigram-based natural language modelling. In Acoustics, Speech, and Signal Processing, IEEE International Conference on . IEEE Computer Society, 825–828

    1991

  47. [55]

    Xiaohui Nie, Youjian Zhao, Zhihan Li, Guo Chen, Kaixin Sui, Jiyang Zhang, Zijie Ye, and Dan Pei. 2019. Dynamic TCP initial windows and congestion control schemes through reinforcement learning. IEEE Journal on Selected Areas in Communications 37, 6 (2019), 1231–1247

    2019

  48. [56]

    George Nychis, Vyas Sekar, David G Andersen, Hyong Kim, and Hui Zhang. 2008. An Empirical Evaluation of Entropy- based Traffic Anomaly Detection. In Proceedings of the 8th ACM SIGCOMM Conference on Internet Measurement . 151–156

    2008

  49. [57]

    Myle Ott, Sergey Edunov, Alexei Baevski, Angela Fan, Sam Gross, Nathan Ng, David Grangier, and Michael Auli. 2019. fairseq: A Fast, Extensible Toolkit for Sequence Modeling. In Proceedings of NAACL-HLT 2019: Demonstrations

    2019

  50. [58]

    Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. 2019. Pytorch: An imperative style, high-performance deep learning library. 20 Zhou, et al. Advances in neural information p...

    2019

  51. [59]

    Konstantinos Poularakis, Qiaofeng Qin, Franck Le, Sastry Kompella, and Leandros Tassiulas. 2021. Generalizable and interpretable deep learning for network congestion prediction. In 2021 IEEE 29th International Conference on Network Protocols (ICNP). IEEE, 1–10

    2021

  52. [60]

    Xi Qin, Tongge Xu, and Chao Wang. 2015. DDoS Attack Detection Using Flow Entropy and Clustering Technique. In International Conference on Computational Intelligence and Security . 412–415

    2015

  53. [61]

    Alec Radford, Karthik Narasimhan, Tim Salimans, Ilya Sutskever, et al. 2018. Improving language understanding by generative pre-training. (2018)

    2018

  54. [62]

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. 2019. Language models are unsupervised multitask learners. OpenAI blog 1, 8 (2019), 9

    2019

  55. [63]

    Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. 2020. Exploring the limits of transfer learning with a unified text-to-text transformer. The Journal of Machine Learning Research 21, 1 (2020), 5485–5551

    2020

  56. [64]

    Shailendra Rathore and Jong Hyuk Park. 2018. Semi-supervised learning based distributed attack detection framework for IoT. Applied Soft Computing 72 (2018), 79–89

    2018

  57. [65]

    Markus Ring, Daniel Schlör, Dieter Landes, and Andreas Hotho. 2019. Flow-based network traffic generation using generative adversarial networks. Computers & Security 82 (2019), 156–172

    2019

  58. [66]

    Gilles Roudière and Philippe Owezarski. 2018. Evaluating the Impact of Traffic Sampling on AATAC’s DDoS Detection. In Proceedings of the Workshop on Traffic Measurements for Cybersecurity . 27–32

    2018

  59. [67]

    Meng Shen, Jinpeng Zhang, Liehuang Zhu, Ke Xu, Xiaojiang Du, and Yiting Liu. 2019. Encrypted traffic classification of decentralized applications on ethereum using feature fusion. In Proceedings of the International Symposium on Quality of Service. 1–10

    2019

  60. [68]

    Ningombam Anandshree Singh, Khundrakpam Johnson Singh, and Tanmay De. 2016. Distributed Denial of Service Attack Detection Using Naive Bayes Classifier Through info Gain Feature Selection. In Proceedings of the International Conference on Informatics and Analytics . 1–9

    2016

  61. [69]

    Mayank Swarnkar and Neminath Hubballi. 2016. OCPAD: One Class Naive Bayes Classifier for Payload based Anomaly Detection. Expert Systems with Applications 64 (2016), 330–339

    2016

  62. [70]

    Daniël van der Steeg, Rick Hofstede, Anna Sperotto, and Aiko Pras. 2015. Real-time DDoS Attack Detection for Cisco IOS Using NetFlow. In 2015 IFIP/IEEE International Symposium on Integrated Network Management (IM) . IEEE, 972–977

    2015

  63. [71]

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. Advances in neural information processing systems 30 (2017)

    2017

  64. [72]

    Zhaohua Wang, Zhenyu Li, Guangming Liu, Yunfei Chen, Qinghua Wu, and Gang Cheng. 2021. Examination of WAN traffic characteristics in a large-scale data center network. In Proceedings of the 21st ACM Internet Measurement Conference. 1–14

    2021

  65. [73]

    Matthias Wichtlhuber, Eric Strehle, Daniel Kopp, Lars Prepens, Stefan Stegmueller, Alina Rubina, Christoph Dietzel, and Oliver Hohlfeld. 2022. IXP Scrubber: Learning from Blackholing Traffic for ML-Driven DDoS Detection at Scale. In Proceedings of SIGCOMM

    2022

  66. [74]

    Keith Winstein and Hari Balakrishnan. 2013. Tcp ex machina: Computer-generated congestion control.ACM SIGCOMM Computer Communication Review 43, 4 (2013), 123–134

    2013

  67. [75]

    Shijie Wu, Ozan Irsoy, Steven Lu, Vadim Dabravolski, Mark Dredze, Sebastian Gehrmann, Prabhanjan Kambadur, David Rosenberg, and Gideon Mann. 2023. Bloomberggpt: A large language model for finance.arXiv preprint arXiv:2303.17564 (2023)

    2023 arXiv

  68. [76]

    Yirui Wu, Dabao Wei, and Jun Feng. 2020. Network attacks detection methods based on deep learning techniques: a survey. Security and Communication Networks 2020 (2020), 1–17

    2020

  69. [77]

    Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and S Yu Philip. 2020. A comprehensive survey on graph neural networks. IEEE transactions on neural networks and learning systems 32, 1 (2020), 4–24

    2020

  70. [78]

    Zhiying Xu, Sivaramakrishnan Ramanathan, Alexander Rush, Jelena Mirkovic, and Minlan Yu. 2022. Xatu: boosting existing DDoS detection systems using auxiliary signals. InProceedings of the 18th International Conference on emerging Networking EXperiments and Technologies. 1–17

    2022

  71. [79]

    Daniel S Yeung, Shuyuan Jin, and Xizhao Wang. 2007. Covariance-matrix Modeling and Detecting Various Flooding Attacks. IEEE Transactions on Systems, Man, and Cybernetics-Part A: Systems and Humans 37, 2 (2007), 157–169

    2007

  72. [80]

    Yucheng Yin, Zinan Lin, Minhao Jin, Giulia Fanti, and Vyas Sekar. 2022. Practical gan-based synthetic ip header trace generation using netshare. In Proceedings of the ACM SIGCOMM 2022 Conference . 458–472

    2022

  73. [81]

    Jielun Zhang, Fuhao Li, Feng Ye, and Hongyu Wu. 2020. Autonomous unknown-application filtering and labeling for dl-based traffic classifier update. In IEEE INFOCOM 2020-IEEE Conference on Computer Communications . IEEE, 397–405. NetFlowGen: Leveraging Generative Pre-training f...

    2020

  74. [82]

    Qizhen Zhang, Kelvin KW Ng, Charles Kazer, Shen Yan, João Sedoc, and Vincent Liu. 2021. Mimicnet: fast performance estimates for data center networks with machine learning. In Proceedings of the 2021 ACM SIGCOMM 2021 Conference . 287–304

    2021

  75. [83]

    Weiyao Zhang, Xuying Meng, and Yujun Zhang. 2022. Dual-track Protocol Reverse Analysis Based on Share Learning. (2022), 51–60

    2022

  76. [84]

    Xinyi Zhang, Gaogang Xie, Xin Wang, Penghao Zhang, Yanbiao Li, and Kavé Salamatian. 2021. Fast online packet classification with convolutional neural network. IEEE/ACM Transactions on Networking 29, 6 (2021), 2765–2778

    2021

  77. [85]

    Panpan Zheng, Shuhan Yuan, and Xintao Wu. 2019. Safe: A neural survival analysis model for fraud early detection. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 33. 1278–1285

    2019

  78. [86]

    Wenbo Zheng, Chao Gou, Lan Yan, and Shaocong Mo. 2020. Learning to classify: A flow-based relation network for encrypted traffic classification. In Proceedings of The Web Conference 2020 . 13–22

    2020

  79. [87]

    Jiawei Zhou. 2023. Generating Semantic Graphs for Natural Language . Ph. D. Dissertation. Harvard University

    2023

  80. [88]

    Jiawei Zhou, Tahira Naseem, Ramón Fernandez Astudillo, Young-Suk Lee, Radu Florian, and Salim Roukos. 2021. Structure-aware Fine-tuning of Sequence-to-sequence Transformers for Transition-based AMR Parsing. In Proceedings of the 2021 Conference on Empirical Methods in Natural ...

    2021

  81. [89]

    Jiawei Zhou, Zhiying Xu, Alexander M Rush, and Minlan Yu. 2020. Automating botnet detection with graph neural networks. arXiv preprint arXiv:2003.06344 (2020)

    2020 arXiv

  82. [2007]

    (2007), 315–320

    Network Monitoring using Traffic Dispersion Graphs (tdgs). (2007), 315–320

    2007

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.