TrafficInstruct: A Multi-Task Network Traffic Dataset and Benchmark for Instruction Fine-Tuning

The paper proposes TrafficInstruct, a new dataset and benchmark for multi-task network traffic analysis instruction fine-tuning, containing raw packet captures and 55000 structured supervised fine-tuning records, covering ten tasks: malicious traffic detection, botnet detection, malicious DNS-over-HTTPS detection, web attack detection, APT detection, encrypted VPN detection, Tor behavior detection, encrypted application/service classification, website fingerprinting, and application classification under concept drift. The data were collected by an automated pipeline from controlled software execution, attack experiments and application activities, with labels supported by collected evidence such as process or socket attribution, activity records and execution results; the dataset is split by complete collection sessions, with samples from the same session kept in the same partition. The benchmark specifies allowed inputs, deterministic label mappings, fixed training/validation/test splits and per-task scoring rules. The authors evaluated a majority class baseline, random forest, an ET-BERT baseline, an unadapted 27B language model, and per-task LoRA adapters trained independently on a shared frozen base, and the results show that task-specific adaptation improves classification performance.