Encrypted web traffic and evolving Internet technologies pose an increasing challenge to network traffic analysis. However, existing traffic classification methods, though effective, require large labeled datasets and complex training. This makes sustaining them prohibitively expensive and difficult in real-world scenarios. To narrow this gap, we propose a novel training-free few-shot network traffic classification framework based on large language models (LLMs). By integrating meta-learning with LLMs, it reduces reliance on labeled data, eliminates task-specific training, and improves performance. Specifically, we first apply an efficient feature extraction method to extract features from traffic flows. We then design meta-tasks that combine task descriptions with textualized features to produce natural language meta-task formulations. Building on these meta-tasks, the LLM performs reasoning to carry out traffic classification. Finally, to mitigate hallucination in the LLM outputs, we exploit the temporal characteristics of network traffic and aggregate predictions over samples within a defined time window. Extensive experiments on three widely-used encrypted traffic datasets demonstrate that our proposed framework outperforms the state-of-the-art methods, achieving an average absolute improvement in F1 score of 9.75, 9.82, and 12.06 percentage points on the three datasets, respectively.
Xingmao Guan, Ning Li, Xueying Han et al.· Cybersecurity· 0 citations
Open-vocabulary object detection test-time adaptation (OVOD-TTA) aims to address the performance degradation that pre-trained base models suffer when encountering image-domain shifts. Existing source-free OVOD-TTA methods rely either on refined test-time information for re-scoring or on pseudo-labels for self-training, leading to significant accuracy degradation when initial predictions are poor. Meanwhile, most conventional source-domain estimation methods recover abstract, sparse representations suitable for the classification task, but fail to capture the dense, concrete features required for detection. To address these issues, we propose PISA, a novel source-free OVOD-TTA method that can be seamlessly integrated into open-vocabulary visual backbones. The core components of our method are the Corruption-Invariant Feature Extractor (CIFE), the Feature Alignment Module (FAM), and a multi-scale alignment framework (BAA). To capture detection-suitable features, we develop CIFE to exploit the invariance of CLIP's visual features across corrupted images, ensuring robustness against various corruptions. We further develop FAM and BAA for the pre-training and adaptation to transform the corruption-invariant features into pseudo-individual source-domain features that are close to the original source-domain features. In this way, dense and concrete pseudo-individual source-domain features are used for supervision instead of unreliable pseudo-label signals. Experiments on the corrupted VOC-C, COCO-C, and LVIS-C benchmarks across three base models demonstrate that PISA substantially improves both the localization precision and the category recognition accuracy of the original models. Notably, PISA achieves state-of-the-art performance without requiring access to source-domain data, surpassing existing methods by 3.92% in AP@50% on COCO-C.
