SamE: Sampling-based Embedding for Learning Representations of the Internet

We have developed SamE, a novel sampling-based embedding technique for learning representations of the Internet. SamE can classify Internet hosts in a scalable and cost effective manner without sacrificing the classification performance. Machine learning has been applied to Internet traffic analysis for a variety of purposes, including botnet detection and application identification. For example, as a major threat on the Internet, a botnet is a group of computers that collaborate together to launch cyberattacks. To analyze related hosts such as the collaborating constituents of a botnet, graph embedding techniques seem to be promising. However, when applying existing graph embedding techniques to Internet-scale traffic data, the time and space complexities become prohibitively high for practical use. To make graph embedding applicable to Internet-scale problems, SamE only samples a subset of nodes to learn elemental representations and aggregates learned elemental representations to generate synthetic representations for all nodes. We have applied SamE to real-world Internet-scale traffic data, and the experimental results show that SamE outperforms existing methods by reducing the data samples required for representation learning by 99% while achieving the same level of classification performance in botnet detection and application identification.