The paper evaluates Jev, a general-purpose decision model, for classifying network traffic using only the first ten packets’ sizes, directions, and inter‑packet times. Across 52,000 records, adding 40 labeled examples improves Jev’s accuracy from 9.80% to 28.42%, yet Random Forest and Extra Trees models trained on 8,000 records achieve higher accuracies of 69.95% and 66.80%. Even with 150 examples, Jev reaches only 34.50% accuracy, and in a paired 100‑record test, Jev’s 29% accuracy and 0.750 s median request time are lower than the generative OpenAI GPT‑5.6 Sol’s 37% accuracy and 6.036 s response time, though Jev incurs lower API charges.
By Shenghe Xu, Lifan Mei
The paper evaluates the common assumption that combining flow statistics and TLS handshake fingerprints improves encrypted command-and-control detection. Using 17,577 TLS flows from 62 real Cobalt Strike captures, the authors show that data leakage and preprocessing choices inflate performance metrics, revealing that the true benefit of multi-view fusion is minimal (0.022 F1). They also uncover that many captures contain only benign traffic and that class imbalance is an artifact of analysis rather than a real feature of the task.
By Hoang-Huy Nguyen-Huu, Van-Tri Phan, Khuong Nguyen-An
arXiv:2608. 15761v1 Announce Type: cross Abstract: Edge-IIoTset is the reference benchmark for machine-learning intrusion detection in the industrial Internet of Things, and results reported on it cluster above 99%.
By Mostafa M. Galal
The paper audits 14 encrypted traffic classification benchmarks to investigate how flow labels are generated. It finds two common labeling strategies—coarse inheritance, which may mislabel flows, and overstrict filtering, which may discard useful flows—leading to inconsistencies between benchmark labels and actual traffic records. The study also quantifies the impact of these labeling practices on classifier accuracy, showing that inherited labels limit balanced accuracy to 0.56–0.76, while filtering can raise macro accuracy from 0.44 to 0.65.
By Sizhe Huang, Shujie Yang
arXiv:2608.21874v1 Announce Type: cross
Abstract: Deep learning has achieved strong performance in encrypted traffic classification (ETC), yet its computational cost limits deployment on resource-con...
By Yuantu Luo, Jun Tao, Xiangyu Xu, Linxiao Yu, Kangying Li
arXiv:2610.16152v1 Announce Type: cross
Abstract: Although post-training significantly enhances model performance, the use of massive undisclosed data raises concerns about benchmark contamination an...
By Hengxiang Zhang, Junxian Liu, Hongxin Wei