Trafficinstruct dataset supports multitask network traffic analysis tuning
TrafficInstruct: A Multi-Task Network Traffic Dataset and Benchmark for Instruction Tuning
Cryptography and SecurityArtificial Intelligence
Summary
Analyzing network traffic to find bad activity like malware or botnets needs clear example data and rules. The paper presents TrafficInstruct, a big dataset with over 55,000 labeled examples from different traffic problems, gathered from real software and attacks. The data is carefully processed to include instructions and answers for training models. The authors tested different methods, showing that adapting models for specific tasks improves how well they detect threats and classify traffic. This supports training computer programs to handle many traffic analysis jobs using clear instructions.
What this means in practice
- •For network security teams: Improve detection systems for malware, botnets, and advanced threats using a well-labeled multitask traffic dataset designed for instruction-based model training.
- •For cybersecurity product developers: Develop new or enhanced threat detection tools that leverage instruction-tuned models trained on diverse network traffic tasks from TrafficInstruct data.$Commercial implications: Enables creation of more accurate threat detection software that can be marketed to enterprises for advanced network protection.
Authors
Zhengdao Li, Hui Wen, Zixuan Wan, Weifeng Zhang, Yan Wu, Benlong Wu, Nenghai Yu, Weiming Zhang, Kejiang Chen
Abstract
Instruction tuning for multi-task network traffic analysis requires data with clearly defined sources, supervision targets, and evaluation conditions. We introduce TrafficInstruct, a newly collected dataset comprising raw packet captures and 55,000 structured supervised fine-tuning records across ten tasks: malware traffic detection, botnet detection, malicious DNS-over-HTTPS detection, Web attack detection, advanced persistent threat detection, encrypted VPN detection, Tor behavior detection, encrypted application/service classification, website fingerprinting, and application classification under concept drift. An automated workflow captures traffic from controlled software executions, attack experiments, and application activities. Labels are supported by task-specific collection evidence, including process or socket attribution, activity records, and execution outcomes. Filtering, sanitization, and task-specific transformations produce instructions, traffic observations, and structured answers. We verify sample sources and partition the dataset by complete collection sessions, keeping all samples from the same session within one partition. The benchmark defines allowed inputs, deterministic label mappings, fixed training/validation/test partitions, and task-wise scoring rules. We evaluate majority-class, random-forest, and ET-BERT baselines, an unadapted 27B language model, and independently trained task-specific LoRA adapters on a shared frozen base. Adapters are selected using validation data and evaluated on the corresponding test sets. Task-specific adaptation improves classification performance, supporting instruction tuning across diverse traffic-analysis tasks.