2 research outputs found
In Search of netUnicorn: A Data-Collection Platform to Develop Generalizable ML Models for Network Security Problems
The remarkable success of the use of machine learning-based solutions for
network security problems has been impeded by the developed ML models'
inability to maintain efficacy when used in different network environments
exhibiting different network behaviors. This issue is commonly referred to as
the generalizability problem of ML models. The community has recognized the
critical role that training datasets play in this context and has developed
various techniques to improve dataset curation to overcome this problem.
Unfortunately, these methods are generally ill-suited or even counterproductive
in the network security domain, where they often result in unrealistic or
poor-quality datasets.
To address this issue, we propose an augmented ML pipeline that leverages
explainable ML tools to guide the network data collection in an iterative
fashion. To ensure the data's realism and quality, we require that the new
datasets should be endogenously collected in this iterative process, thus
advocating for a gradual removal of data-related problems to improve model
generalizability. To realize this capability, we develop a data-collection
platform, netUnicorn, that takes inspiration from the classic "hourglass" model
and is implemented as its "thin waist" to simplify data collection for
different learning problems from diverse network environments. The proposed
system decouples data-collection intents from the deployment mechanisms and
disaggregates these high-level intents into smaller reusable, self-contained
tasks.
We demonstrate how netUnicorn simplifies collecting data for different
learning problems from multiple network environments and how the proposed
iterative data collection improves a model's generalizability
netFound: Foundation Model for Network Security
In ML for network security, traditional workflows rely on high-quality
labeled data and manual feature engineering, but limited datasets and human
expertise hinder feature selection, leading to models struggling to capture
crucial relationships and generalize effectively. Inspired by recent
advancements in ML application domains like GPT-4 and Vision Transformers, we
have developed netFound, a foundational model for network security. This model
undergoes pre-training using self-supervised algorithms applied to readily
available unlabeled network packet traces. netFound's design incorporates
hierarchical and multi-modal attributes of network traffic, effectively
capturing hidden networking contexts, including application logic,
communication protocols, and network conditions.
With this pre-trained foundation in place, we can fine-tune netFound for a
wide array of downstream tasks, even when dealing with low-quality, limited,
and noisy labeled data. Our experiments demonstrate netFound's superiority over
existing state-of-the-art ML-based solutions across three distinct network
downstream tasks: traffic classification, network intrusion detection, and APT
detection. Furthermore, we emphasize netFound's robustness against noisy and
missing labels, as well as its ability to generalize across temporal variations
and diverse network environments. Finally, through a series of ablation
studies, we provide comprehensive insights into how our design choices enable
netFound to more effectively capture hidden networking contexts, further
solidifying its performance and utility in network security applications