**Title: Leveraging Contrastive Learning and Correlation Clustering for Network Telescope Data Sequences

Abstract: Deciphering the behavior of Internet scanners is a complex undertaking, frequently necessitating the identification of connections between different sources. However, this process is often hindered by a lack of available semantic annotations. This study explores the feasibility of estimating semantically significant pairwise relationships within sequences of network flow records through contrastive learning, eliminating the need for pretraining or annotated data. To achieve this, we introduce a transformer-based architecture designed to embed minimally processed network flow sequences, which is then trained using contrastive learning techniques. By utilizing the similarity metrics derived from this model, we formulate and resolve a correlation clustering problem on a local scale. Our experimental results demonstrate that the learned similarities are, on average, stronger for sequences generated by the same source compared to those from distinct sources. This characteristic proves robust, generalizing effectively to previously unseen sequences and sources. Furthermore, the correlation clustering approach produces groupings that align with established scanner labels. The full source code required to reproduce these experiments and implement the algorithms has been made publicly accessible.

Source: arXiv Generated at: 2026-06-04 00:00:00 UTC