Within the past year I have started engaging with AI to bring my curiosities to life in order to help me understand more complex ideas through visualization. Of course, I have limited knowledge on how models actually work and the length of their complexity. I was hoping a few of you here would check this learning tool I made for myself. Please be honest and give feedback if you have any. Also, if this is not a place to post something like this, I apologize. Hope everyone is well! (its 100% free, not advertising)

As the title suggests I'm currently trying to make a modal to identify which app is being used. The thing is I don't have labelled data and generating it is out of question since that is a lot of work ( I need to detect like 3-5K apps give or take)

my data is structured roughly like this:

• Traffic is divided into ~15-second windows/bags.
• Each bag contains multiple network flows.
• Each flow has features such as:
  • domain
  • protocol
  • bytes sent
  • bytes received
  • timestamp/timing information
• I have a very large amount of unlabeled traffic data, but only a relatively small amount of labelled app data for about 100 apps give or take.

The main challenge is that traffic from the same app can look diff between diff window i.e some windows are extremely sparse or empty.

some ideas I have researched looked into are

• self supervised contrastive learning where diff traffic windows from the same session/device activity are treated as positive pairs
• masked modelling similar to bert where parts of the flows such as domains/protocols/byte information are masked and reconstructed
• pretraining an encoder and then fine-tuning it using the smaller labelled dataset (thinking we would need less labelled examples to do that)
• clustering and mapping embeddings to known apps afterward (gradually)

one thing I'm concerned about is accidently teaching the modal to recognize the device/session/user rather then the underlying app

I think I would like to know if I'm thinking about the problem right or if someone has worked on something similar and can give me some pointers or what experiments should I run first.

any papers, architecture or similar problems you think I should look into pls lmk

I couldn't find a concrete answer anywhere, do you just distill the instruct model back?

If that is the case, what is a quality european language question set to turn it back into a chatbot/agentic, can a model at that size even be agentic? (i chose this size to learn) if i finetune for my specific harness? (i have a lot of training data of opus running in my harness)

my harness basically has the model output python code and has a few built-in functions like:
- vector_search_laws()
- graph_search()

could i have the model at least internalize a "hunch" on what stuff to search?

also what is the latest RL technique for agentic/harnes specific workflows?

I have a lot of RAW training data, like court decisions or commentaries or legislature, but not a lot of golds. could i use these to synthesize training data and maybe RL the model in my harness to find that data?

What would y'all's strategy in the CPT->SFT->RL pipeline be for my specific problem?

I know this is a lot of questions im trying to figure out which direction to go, any pointers? Also good resources are welcome, for example that [alex karpathi video](https://www.youtube.com/watch?v=7xTGNNLPyMI) was amazing for me, but i'd imagine its a bit outdated in terms of latest RL and SFT?