New Directions in Automated Traffic Analysis

Despite the prevalence of machine learning in many network traffic analysis tasks, from application identification to intrusion detection, the aspects of the machine learning pipeline that ultimately determine the performance of the model---feature selection and representation, model selection, and parameter tuning---remain manual and painstaking. This paper presents a method to automate these steps. We introduce nPrint, a tool that generates a unified packet representation that is amenable for representation learning and model training. We integrate nPrint with automated machine learning (AutoML), resulting in nPrintML, a pipeline that can quickly automate many network traffic analysis tasks. nPrintML often outperforms best known results for existing problems while automating many manual steps of the process. We have released nPrint, nPrintML, and the corresponding datasets from our evaluation to enable future work to build on these methods.