TrafficInstruct: A Multi-Task Network Traffic Dataset and Benchmark for Instruction Tuning

Summary

TrafficInstruct is a dataset of raw packet captures and 55,000 structured supervised fine-tuning records spanning ten network traffic analysis tasks, including malware, botnet, Tor, and VPN detection. Labels come from task-specific collection evidence such as process or socket attribution, and sessions are kept within a single partition to avoid leakage. Task-specific LoRA adapters on a shared frozen 27B base model improve classification performance over the baselines.