The paper evaluates Jev, a general-purpose decision model, for classifying network traffic using only the first ten packets’ sizes, directions, and inter‑packet times. Across 52,000 records, adding 40 labeled examples improves Jev’s accuracy from 9.80% to 28.42%, yet Random Forest and Extra Trees models trained on 8,000 records achieve higher accuracies of 69.95% and 66.80%. Even with 150 examples, Jev reaches only 34.50% accuracy, and in a paired 100‑record test, Jev’s 29% accuracy and 0.750 s median request time are lower than the generative OpenAI GPT‑5.6 Sol’s 37% accuracy and 6.036 s response time, though Jev incurs lower API charges.
By Shenghe Xu, Lifan Mei
The paper evaluates the common assumption that combining flow statistics and TLS handshake fingerprints improves encrypted command-and-control detection. Using 17,577 TLS flows from 62 real Cobalt Strike captures, the authors show that data leakage and preprocessing choices inflate performance metrics, revealing that the true benefit of multi-view fusion is minimal (0.022 F1). They also uncover that many captures contain only benign traffic and that class imbalance is an artifact of analysis rather than a real feature of the task.
By Hoang-Huy Nguyen-Huu, Van-Tri Phan, Khuong Nguyen-An
arXiv:2608. 15761v1 Announce Type: cross Abstract: Edge-IIoTset is the reference benchmark for machine-learning intrusion detection in the industrial Internet of Things, and results reported on it cluster above 99%.
By Mostafa M. Galal
The paper audits 14 encrypted traffic classification benchmarks to investigate how flow labels are generated. It finds two common labeling strategies—coarse inheritance, which may mislabel flows, and overstrict filtering, which may discard useful flows—leading to inconsistencies between benchmark labels and actual traffic records. The study also quantifies the impact of these labeling practices on classifier accuracy, showing that inherited labels limit balanced accuracy to 0.56–0.76, while filtering can raise macro accuracy from 0.44 to 0.65.
By Sizhe Huang, Shujie Yang
arXiv:2608.21874v1 Announce Type: cross
Abstract: Deep learning has achieved strong performance in encrypted traffic classification (ETC), yet its computational cost limits deployment on resource-con...
By Yuantu Luo, Jun Tao, Xiangyu Xu, Linxiao Yu, Kangying Li
arXiv:2610.16152v1 Announce Type: cross
Abstract: Although post-training significantly enhances model performance, the use of massive undisclosed data raises concerns about benchmark contamination an...
By Hengxiang Zhang, Junxian Liu, Hongxin Wei
arXiv:2608.30745v1 Announce Type: new
Abstract: The widespread adoption of encrypted traffic poses severe challenges to current security situational awareness systems based on network traffic monitor...
By Ze Chen, Qiming Yu, Zijia Song, Guozheng Yang, Wei Yan
arXiv:2602. 14161v2 Announce Type: replace Abstract: Detecting prompt injection, jailbreak attacks, and harmful requests is critical for deploying LLM-based agents safely, yet current evaluation practices in this literature overestimate generalization.
By Max Fomin
The paper audits the widely used ISOT/Kaggle Fake and Real News corpus and finds that extremely high reported accuracies (≈0.98) are largely due to shortcut signals rather than genuine veracity detection. A simple TF‑IDF linear classifier achieves perfect F1 when using only subject metadata, and even after removing metadata, newswire tags, and duplicate documents, the F1 drops only modestly, indicating that editorial style rather than specific tokens drives performance. Under topic‑disjoint and temporal transfer tests, performance collapses, and models transfer poorly to the independent LIAR benchmark, showing that within‑corpus scores reflect source and topic separability, not truth verification.
whyItMatters:"The study demonstrates that current high accuracy metrics on this fake‑news dataset are misleading, highlighting the need for more robust evaluation protocols that guard against shortcut learning."
By Yuvraj Verma
arXiv:2606. 00155v1 Announce Type: cross Abstract: Modern network intrusion detection systems (NIDS) are caught in a structural contradiction: the protocols carrying the highest threat intelligence are precisely those encrypted under TLS 1.
By Vivek Kumar Sharma
HE‑OFT is a cryptographically secure one‑shot federated fine‑tuning protocol that protects privacy by exchanging only one encrypted contribution and never revealing the trained model. Each client fine‑tunes a low‑rank adapter and a classifier head on a frozen public backbone, keeps the adapter, and uploads an encrypted head displacement that the server combines using multiparty CKKS without decryption. On four text classification tasks and one vision task, HE‑OFT achieves 61–79 % accuracy, retaining 85–96 % of the accuracy of a disclosed model, while a test‑time query takes 443.1–1713.1 s on one core or 56.1–255.1 s on a GPU, with level restoration reducing traffic from 1.6 GiB to 13.5 MiB.
By Halil \.Ibrahim Kanpak, Sinem Sav, Alptekin K\"up\c{c}\"u
The study investigates what knowledge a student model inherits from its teachers beyond accuracy when using knowledge distillation for encrypted‑traffic classification. By distilling a 101k‑parameter student from two teachers of equal accuracy but different construction, the authors test ten hypotheses over a year of real TLS traffic, finding that unknown‑traffic detection and shortcut reliance can transfer depending on temperature settings and model size, while other abilities do not. The results show that distillation can propagate teacher habits, but some inherited capabilities can also be achieved without a teacher.
By Mahmoud Abbasi