netFound-base

Description

netFound is a network traffic encoder model that uses transformer architecture and includes a pretraining phase on unlabeled data to achieve high results.

Key features:

• netFound takes raw PCAP data as input
• netFound can (and need) be pretrained on the unlabeled dataset
• netFound uses Hierarchical Transformer architecture to take into account packet burst and flow behavior
• netFound uses burst metadata (inter arrival time, number of bytes per burst, etc)

Details

• Model config: base (12 layers, 12 attention heads, 768 hidden size)
• Pretraining details: 128 GPUs, 70k steps, ~10bln tokens seen

Source code

https://github.com/SNL-UCSB/netFound