In one embodiment, a device in a network generates a feature vector based on traffic flow data regarding one or more traffic flows in the network. The device makes a determination as to whether the generated feature vector is already represented in a training dataset dictionary by one or more feature vectors in the dictionary. The device updates the training dataset dictionary based on the determination by one of: adding the generated feature vector to the dictionary when the generated feature vector is not already represented by one or more feature vectors in the dictionary, or incrementing a count associated with a particular feature vector in the dictionary when the generated feature vector is already represented by the particular feature vector in the dictionary. The device generates a training dataset based on the training dataset dictionary for training a machine learning-based traffic flow analyzer.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method comprising: generating, by a device in a network, a feature vector based on traffic flow data regarding one or more traffic flows in the network; making, by the device, a determination as to whether the generated feature vector is already represented in a training dataset dictionary by one or more feature vectors in the dictionary; updating, by the device, the training dataset dictionary based on the determination as to whether the generated feature vector is already represented in the training dataset dictionary by one or more feature vectors in the dictionary, wherein updating the training dataset dictionary comprises one of: adding the generated feature vector to the dictionary when the generated feature vector is not already represented by one or more feature vectors in the dictionary, or incrementing a count associated with a particular feature vector in the is dictionary when the generated feature vector is already represented by the particular feature vector in the dictionary; and generating, by the device, a training dataset based on the training dataset dictionary for training a machine learning-based traffic flow analyzer. 2. The method as in claim 1, wherein the training dataset comprises a plurality of labels, and wherein the machine learning-based traffic flow analyzer comprises a machine learning-based traffic flow classifier. 3. The method as in claim 1, wherein the traffic flow data comprises header information for one or more encrypted traffic flows. 4. The method as in claim 1, wherein adding the generated feature vector to the dictionary comprises: initializing, by the device, a count associated with the generated feature vector. 5. The method as in claim 1, wherein making the determination as to whether the generated feature vector is already represented in the training dataset dictionary comprises: computing, by the device, function values between the generated feature vector and feature vectors in the training dataset dictionary. 6. The method as in claim 5, wherein the function values are computed using a squared exponential function. 7. The method as in claim 1, wherein generating the training dataset based on the training dataset dictionary comprises: receiving, at the device, one or more parameters indicative of a particular traffic type for a target network to which the traffic flow analyzer is to be deployed; identifying, by the device, one or more feature vectors in the dictionary that are associated with the particular traffic type; and determining, by the device, a representation of the identified one or more feature vectors in the generated training dataset based on the received one or more parameters. 8. The method as in claim 7, wherein the representation of the identified one or more feature vectors in the generated training dataset excludes the identified one or more feature vectors in the dictionary associated with the particular traffic type from the generated training dataset. 9. The method as in claim 1, wherein the machine learning-based traffic flow analyzer is configured to detect malicious traffic flows. 10. An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed operable to: generate a feature vector based on traffic flow data regarding one or more traffic flows in the network; make a determination as to whether the generated feature vector is already represented in a training dataset dictionary by one or more feature vectors in the dictionary; update the training dataset dictionary based on the determination as to whether the generated feature vector is already represented in the training dataset dictionary by one or more feature vectors in the dictionary, wherein the apparatus updates the training dataset dictionary by one of: adding the generated feature vector to the dictionary when the generated feature vector is not already represented by one or more feature vectors in the dictionary, or incrementing a count associated with a particular feature vector in the dictionary when the generated feature vector is already represented by the particular feature vector in the dictionary; and generate a training dataset based on the training dataset dictionary for training a machine learning-based traffic flow analyzer. 11. The apparatus as in claim 10, wherein the training dataset comprises a plurality of labels, and wherein the machine learning-based traffic flow analyzer comprises a machine learning-based traffic flow classifier. 12. The apparatus as in claim 10, wherein the traffic flow data comprises header information for one or more encrypted traffic flows. 13. The apparatus as in claim 10, wherein the apparatus adds the generated feature vector to the dictionary by: initializing a count associated with the generated feature vector. 14. The apparatus as in claim 10, wherein the apparatus makes the determination as to whether the generated feature vector is already represented in the training dataset dictionary by: computing function values between the generated feature vector and feature vectors in the training dataset dictionary. 15. The apparatus as in claim 14, wherein the function values are computed using a squared exponential function. 16. The apparatus as in claim 10, wherein the apparatus generates the training dataset based on the training dataset dictionary by: receiving one or more parameters indicative of a particular traffic type for a target network to which the traffic flow analyzer is to be deployed; identifying one or more feature vectors in the dictionary that are associated with the particular traffic type; and determining a representation of the identified one or more feature vectors in the generated training dataset based on the received one or more parameters. 17. The apparatus as in claim 16, wherein the representation of the identified one or more feature vectors in the generated training dataset excludes the identified one or more feature vectors in the dictionary associated with the particular traffic type from the generated training dataset. 18. The apparatus as in claim 10, wherein the machine learning-based traffic flow analyzer is configured to detect malicious traffic flows. 19. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising: generating, by the device, a feature vector based on traffic flow data regarding one or more traffic flows in the network; making, by the device, a determination as to whether the generated feature vector is already represented in a training dataset dictionary by one or more feature vectors in the dictionary; updating, by the device, the training dataset dictionary based on the determination as to whether the generated feature vector is already represented in the training dataset dictionary by one or more feature vectors in the dictionary, wherein updating the training dataset dictionary comprises one of: adding the generated feature vector to the dictionary when the generated feature vector is not already represented by one or more feature vectors in the dictionary, or incrementing a count associated with a particular feature vector in the dictionary when the generated feature vector is already represented by the particular feature vector in the dictionary; and generating, by the device, a training dataset based on the training dataset dictionary for training a machine learning-based traffic flow analyzer. 20. The computer-readable medium as in claim 19, wherein making the determination as to whether the generated feature vector is already represented in the training dataset dictionary comprises: computing, by the device, function values between the generated feature vector and feature vectors in the training dataset dictionary.