PRISM-2026:엔드포인트 기반 자동 라벨링 다계층 네트워크 트래픽 데이터셋

초록

As encryption becomes pervasive, the availability of accurately labeled, high-quality datasets is a central challenge in network traffic classification. Existing datasets rely on single-application isolation or time-interval segmentation and thus fail to capture the concurrent traffic of real hosts or suffer from limited label integrity. This study builds and releases PRISM-2026, a multi-level network traffic dataset created with PRISM, an automatic labeling framework that obtains labels directly from the endpoints generating the traffic. PRISM-2026 comprises 1,320,366 sessions collected from seven in-use hosts over three days, with each session annotated by five-tuple endpoint information and three-level labels spanning process, service, and site. In particular, service-level labeling for svchost.exe and SNI-based site-level labeling for browsers refine the shared-host-process and browser traffic that process-level labels alone cannot distinguish, yielding two label sets at the process level (108 classes) and application level (89 classes). In baseline experiments with representative classifiers (ET-BERT, TSHIRT, 2D CNN, XGBoost), XGBoost achieved the highest accuracy (0.917).

키워드