SNAKE: A Sustainable and Multi-functional Traffic Analysis System utilizing Specialized Large-Scale Models with a Mixture of Experts Architecture

2025-03-18

AI Summary

Network traffic classification faces persistent challenges in multi-attribute collaborative modeling, rigid knowledge expansion, and poor adaptability to dynamic environments. Method: This paper proposes a sustainable-evolution-oriented multi-task traffic analysis system. It introduces a novel Multi-gated Mixture-of-Experts (MoE) architecture that integrates hierarchical attribute modeling, tower-style feature fusion, and intelligent gating configuration—enabling modular model integration and incremental knowledge expansion. Contribution/Results: The system achieves unified, scalable identification of encapsulated protocols, application types, and multiple categories of malicious behaviors. It significantly improves cross-task generalization and evolutionary efficiency. Deployed in production, it integrates multiple models and demonstrates both high accuracy and sustained learnability under continuous data evolution.

Technology Category

• Machine Learning: Mixture of Experts (MoE)
• Computer Vision: Multi-modal Vision
• Multiagent Systems: Multiagent Learning

Application Category

• Web Mining and Content Analysis: Models for Web evolution
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

The rapid advancement of internet technology has led to a surge in data transmission, making network traffic classification crucial for security and management. However, there are significant deficiencies in its efficiency for handling multiattribute analysis and its ability to expand model knowledge, making it difficult to adapt to the ever-changing network environment and complex identification requirements. To address this issue, we proposed the SNAKE (Sustainable Network Analysis with Knowledge Exploration) system, which adopts a multi-gated mixture of experts architecture to construct a multi-functional traffic classification model. The system analyzes traffic attributes at different levels through multiple expert sub-models, providing predictions for these attributes via gating and a final Tower network. Additionally, through an intelligent gating configuration, the system enables extremely fast model integration and evolution across various knowledge expansion scenarios. Its excellent compatibility allows it to continuously evolve into a multi-functional largescale model in the field of traffic analysis. Our experimental results demonstrate that the SNAKE system exhibits remarkable scalability when faced with incremental challenges in diverse traffic classification tasks. Currently, we have integrated multiple models into the system, enabling it to classify a wide range of attributes, such as encapsulation usage, application types and numerous malicious behaviors. We believe that SNAKE can pioneeringly create a sustainable and multifunctional large-scale model in the field of network traffic analysis after continuous expansion.

Problem

• Addresses inefficiency in multiattribute network traffic analysis.
• Enhances model adaptability to dynamic network environments.
• Facilitates rapid integration and evolution of traffic classification models.

Innovation

• Multi-gated mixture of experts architecture
• Intelligent gating for fast model integration
• Scalable multi-functional traffic classification model