fpnt: A flexible preprocessing framework for network traffic analysis

초록

While network traffic analysis (NTA) increasingly requires diverse features across different classification granularities, existing preprocessing tools often suffer from rigid data structures, limited protocol support, or high memory overhead when handling large-scale features. These constraints force researchers to rebuild monitoring pipelines from scratch for novel feature sets. To address these limitations, we propose fpnt, an open-source C++ framework designed for flexible and rapid NTA preprocessing. fpnt allows researchers to define custom traffic granularity levels-including packet, flow, and flowset-and leverages tshark for extensible protocol dissection. By supporting function-based plugins and configurable CSV schemas, the framework facilitates rapid prototyping while ensuring data correctness. Our evaluation shows that fpnt achieves processing speeds comparable to existing preprocessing tools via file-level multiprocessing. Furthermore, through integration with an end-to-end AutoML pipeline, we demonstrate that fpnt can extract complex features which can be used in encrypted application identification. fpnt thus provides an adaptable tool that bridges the gap between raw traffic data and high-performance machine learning workflows.

키워드