Traffic Analysis and Recognition in Data Insufficient Scenarios

Network traffic recognition is pivotal for modern network observability and has therefore garnered considerable attention from both academia and industry. However, existing solutions often rely on impractical assumptions regarding data abundance, which contradict our comprehensive analysis of traffic data from a live financial production environment. The practical landscape of traffic recognition is characterized by numerous challenges, including stringent privacy constraints, device limitations, and the scarcity of training samples in dynamic network conditions, resulting in severe data insufficiency. To address these challenges, we propose TARDIS, a network traffic recognition framework designed specifically for data-insufficient scenarios. TARDIS introduces two novel designs: Payload-agnostic Hierarchical Feature Extraction, which exploits domain knowledge to extract discriminative features from limited information, and Semi-supervised Pre-training based on Sequence Prediction, which effectively utilizes hybrid historical data to enhance model adaptation. Our comprehensive evaluation across multiple datasets, including a self-collected real-world financial dataset (FinApps) and several publicly available ones, demonstrates the effectiveness of TARDIS. Notably, in challenging few-shot scenarios with only 50 training samples per class, TARDIS outperforms the best-performing baseline by 7.13% in accuracy.