论文库

原文摘要

Pervasive encryption makes large-scale labeling infeasible for traffic analysis, while security operations demand edge analysis to avert service degradation and vulnerabilities. These pressures have produced two research lines that advance 1) versatile analysis, via network foundation models for low label dependency, and 2) efficient analysis, via hardware offloading for low analysis latency. However, co-achieving versatility and efficiency via such lines has appeared incompatible, with prior work advancing one while compromising the other, yet we show that this incompatibility is a consequence of polarized design choices across the three components of traffic analysis systems, i.e., traffic processing, model architecture, and analysis execution. In response, we present Nepco, a versatile yet efficient network traffic analysis system that offloads network foundation models to SmartNIC. Our key observation is that discriminative traffic information often exhibits localized patterns within byte sequences, motivating versatile yet efficient localized byte-sequence modeling. To exploit this without incurring the latency bottlenecks of complex encoding steps, we employ a hardware-friendly processing strategy that directly embeds raw byte sequences. To maintain versatility across diverse tasks characterized by spatially shifting features, we explore an observation-driven convolution architecture equipped with hardware-friendly scoring and gating designs. By exploiting translation invariance, this design dynamically locates and extracts salient semantic signatures irrespective of their byte-level offsets. We prototype Nepco on the NVIDIA BlueField-3 SmartNIC with multi-engine collaborative analysis execution. The experimental results demonstrate that Nepco achieves macro F1 competitive with the best performances achieved by 8 state-of-the-art network foundation models...