{'fraction_non_alphanumeric': 0.017277125086385625, 'fraction_numerical': 0.00138217000691085, 'mean_word_length': 5.766355140186916, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
SamE: Sampling-based Embedding for Learning Representations of the Internet

We have developed SamE, a novel sampling-based embedding technique for learning representations of the Internet. SamE can classify Internet hosts in a scalable and cost effective manner without sacrificing the classification performance. Machine learning has been applied to Internet traffic analysis for a variety of purposes, including botnet detection and application identification. For example, as a major threat on the Internet, a botnet is a group of computers that collaborate together to launch cyberattacks. To analyze related hosts such as the collaborating constituents of a botnet, graph embedding techniques seem to be promising. However, when applying existing graph embedding techniques to Internet-scale traffic data, the time and space complexities become prohibitively high for practical use. To make graph embedding applicable to Internet-scale problems, SamE only samples a subset of nodes to learn elemental representations and aggregates learned elemental representations to generate synthetic representations for all nodes. We have applied SamE to real-world Internet-scale traffic data, and the experimental results show that SamE outperforms existing methods by reducing the data samples required for representation learning by 99% while achieving the same level of classification performance in botnet detection and application identification.