NetAgent: Multi-Task Agentic Network Traffic Analysis Made Practical

2026-10-05

AI Summary

This study addresses the limited generalization of task-specific models and the vulnerability of foundation models to distribution shifts in network traffic analysis by proposing the first multi-task agent framework. The approach leverages large language models for knowledge-enhanced planning and dynamic rescheduling, overcoming traditional fixed-pipeline constraints through knowledge mapping, a unified code execution space, and a three-tier memory mechanism to enable training-free complex traffic analysis. The system integrates over 150 validated tools while supporting sandbox runtime repair and long-term knowledge consolidation. Evaluated across nine benchmarks, it comprehensively outperforms existing baselines, achieving an F1 score of 90.04% on unseen data and demonstrating exceptional generalizability and robustness.

Abstract

Network traffic analysis is central to network security, spanning tasks from intrusion detection to encrypted traffic classification. Existing approaches either train task-specific models that generalize poorly or rely on costly traffic foundation models that still struggle under distribution shift. We present NetAgent, the first agentic framework for multi-task traffic analysis. Through a carefully designed agent loop, NetAgent supports complex task understanding, on-the-fly decomposition and orchestration, dynamic replanning, and long-horizon analysis, without task-specific training. It introduces five key designs: (1) knowledge-augmented workflow planning that maps attack knowledge to traffic features to bridge the semantic gap; (2) a comprehensive tool action space with 150+ verified tools extracted from 50+ published systems; (3) a unified code execution space for flexible action composition; (4) a three-tier memory for long-term knowledge consolidation; and (5) sandboxing and runtime repair for reliable execution. Across 9 major benchmarks, NetAgent outperforms all baselines (23 single-task and 5 multi-task) on nearly all tasks and generalizes substantially better to unseen traffic distribution (90.04% F1 vs. 2.74% and 3.04% for the best single-task and multi-task baselines) and under realistic background shift (4.85-point F1 drop vs. 74.88-point and 74.80-point drop for the best single-task and multi-task baselines). These results reveal that existing methods owe much of their reported success to overfitting dataset-specific patterns and degrade sharply in realistic network environments, while NetAgent's agentic design remains accurate, generalizable, and robust.

Problem

• Network Traffic Analysis
• Multi-Task Learning
• Distribution Shift
• Generalization
• Overfitting

Innovation

• Agentic Framework
• Multi-Task Network Traffic Analysis
• Knowledge-Augmented Workflow Planning
• Tool Action Space
• Three-Tier Memory