Network Traffic Foundation Model with Adaptation via In-Context Learning and Mixture-of-Experts

Network traffic patterns vary significantly across collection environments, which often degrades the generalization capability of existing models. This motivates the need for a foundation model that can capture the underlying patterns of network traffic independent of collection environments and can be shared across multiple downstream tasks. In this work, we propose a foundation model specialized for network traffic data. After building a foundation model, our framework leverages In-Context Learning (ICL) and incorporates a Mixture-of-Experts (MoE) architecture for downstream tasks, such as intrusion type classification, utilizing the foundation model. To assess the validity of the proposed approach, we conduct ablation studies on ICL and MoE components, demonstrating their respective contributions to adaptability and efficiency. This study highlights the necessity of a universal foundation model for network traffic analysis and suggests a promising direction toward building scalable, general-purpose solutions for future network intelligence applications.