arXiv:2608. 15504v1 Announce Type: new Abstract: Encrypted traffic classification is vital for network security, yet real-world deployments are inherently sensitive to rare but high-loss errors such as misclassification of malicious traffic.
arXiv:2603.25507v2 Announce Type: replace-cross Abstract: Network Traffic Classification (NTC) increasingly relies on data-driven models, yet its practical deployment is often constrained by limited...
The paper proposes a human-centered framework for validating the semantic soundness of machine learning models used in network traffic classification. It extends existing knowledge-generation methods by integrating data, models, explainability tools, visualizations, and expert reasoning to iteratively explore, verify, and refine model behavior and preprocessing steps. The framework is built on literature findings, benchmark analyses, XAI experience, and expert feedback, offering practical guidance for ensuring models learn trustworthy, semantically meaningful patterns rather than spurious correlations.
arXiv:2606. 04517v1 Announce Type: cross Abstract: Graph-based deep learning methods have been widely employed in encrypted traffic analysis to exploit latent correlations across different granularities.
The paper demonstrates that encrypted traffic classification accuracy can be dramatically inflated by the choice of data split protocol. Using the same model and code, macro‑F1 scores drop from 0.992 under a standard random split to 0.567 when flows from a single packet capture are kept on one side of the split, a gap of 0.426 that is statistically significant. The authors evaluate multiple split strategies on QUIC traffic, showing that server‑disjoint splitting harms performance while other splits are comparable, and provide a diagnostic based on single‑identifier probes to identify the appropriate split axis before training.
arXiv:2608. 15465v1 Announce Type: cross Abstract: Identification of IoT device types from passive traffic is increasingly used for security management in enterprise and ISP networks.
arXiv:2606. 17109v1 Announce Type: cross Abstract: Given their effectiveness in modeling the relational structure among network traffic flows, graph neural networks (GNNs) have been widely adopted in network intrusion detection systems (NIDSs).
arXiv:2609.23521v1 Announce Type: new Abstract: Residential traffic classification supports service management, but learning across homes must account for heterogeneous traffic and privacy constraint...
arXiv:2512. 24625v3 Announce Type: replace-cross Abstract: Accurate traffic prediction is essential for Intelligent Transportation Systems, including ride-hailing, urban road planning, and vehicle fleet management.
Machine learning (ML) has become the dominant approach for network traffic classification, achieving very high predictive performance. However, a model is only valuable if it learns semantically meani...
arXiv:2504. 01882v2 Announce Type: replace Abstract: The use of DNS over HTTPS (DoH) tunneling by an attacker to hide malicious activity within encrypted DNS traffic poses a serious threat to network security, as it allows malicious actors to bypass traditional monitoring and intrusion detection systems while evading detection by conventional traffic analysis techniques.
RiskTraf introduces a risk-extrapolated residual learning approach for multi-variate traffic flow prediction, leveraging raw flow, speed, and occupancy data from the new PEMSB-3V benchmark. The method freezes a trained spatio-temporal backbone and adds a lightweight residual head that learns from historical speed and occupancy to correct flow predictions across different traffic regimes. Experiments show consistent improvements over various backbones and outperform existing debiasing and distribution-shift adaptation techniques.