New Directions in Automated Traffic Analysis

Despite the use of machine learning for many network traffic analysis tasks\nin security, from application identification to intrusion detection, the\naspects of the machine learning pipeline that ultimately determine the\nperformance of the model -- feature selection and representation, model\nselection, and parameter tuning -- remain manual and painstaking. This paper\npresents a method to automate many aspects of traffic analysis, making it\neasier to apply machine learning techniques to a wider variety of traffic\nanalysis tasks. We introduce nPrint, a tool that generates a unified packet\nrepresentation that is amenable for representation learning and model training.\nWe integrate nPrint with automated machine learning (AutoML), resulting in\nnPrintML, a public system that largely eliminates feature extraction and model\ntuning for a wide variety of traffic analysis tasks. We have evaluated nPrintML\non eight separate traffic analysis tasks and released nPrint and nPrintML to\nenable future work to extend these methods.\n