Pith. sign in

REVIEW 4 major objections 6 minor 52 references

Respond to Change with Constancy: Instruction-tuning with LLM for Non-I.I.D. Network Traffic Classification

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that instruction-tuning a large language model on flow-interaction graphs, rather than on single-flow features, keeps encrypted traffic classification accurate when application versions, time windows, or botnet types…

desk verdict A coherent LLM+graph method for OOD encrypted traffic classification with plausible gains, but test-set-tuned hyperparameters and missing reproducibility make the headline numbers not yet trustworthy. read the letter →

arxiv 2505.20866 v1 pith:NQZPIYZ6 submitted 2025-05-27 cs.CR cs.AIcs.NI

Xinjie Lin , Gang Xiong , Gaopeng Gou , Wenqi Dong , Jing Yu , Zhen Li , Wei Xia This is my paper
classification cs.CRcs.AIcs.NI
keywords EncryptedtrafficclassificationOut-of-distributiongeneralizationLargelanguagemodelsInstructiontuningrelationgraphBURSTstructureSelf-supervisedlearningNetworksecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Encrypted traffic classifiers usually assume the traffic they see at test time comes from the same distribution they trained on, an assumption that breaks when applications update, time passes, or new malware types appear. This paper tries to establish that an instruction-tuned large language model can absorb that drift instead of fighting it, provided the input is a graph of how network flows form BURSTs, which are clusters of flows that start within roughly one second of one another. The proposed model, ETooL, turns traffic into a Traffic Relation Graph, aligns graph structure with the language model's token space through contrastive learning, then tunes only a small projection layer using a self-supervised BURST graph matching task followed by task-specific instructions, with the LLM backbone frozen. The paper reports F1 scores of 93.19% on same-distribution app classification, 74.88% and 72.13% on time-shift and version-shift app tasks, and 95.03% on binary botnet detection, with the largest margins over baselines appearing exactly in the out-of-distribution settings. If correct, this means accurate traffic identification after distribution shifts is achievable without collecting labels from the new distribution.

What carries the argument

The central object is the Traffic Relation Graph (TRG), built from flow-level BURST structures: each node is a network flow carrying a raw datagram byte-pair sequence and a directed packet-size sequence, burst edges connect flows whose start timestamps fall within a small threshold γ, chosen as 1 second, and adjacency edges connect the last flow of one BURST to the first and last flows of the next. The load-bearing mechanism is the two-stage instruction tuning: a contrastive objective aligns the graph encoder's structure-level representation with a flow encoder's node-level representation, a self-supervised BURST graph matching task teaches the LLM to reorder disrupted BURST traffic features by matching them to graph nodes, and a final task-specific instruction tune adapts the small structure-aware projection head to classification. All LLM and graph-encoder parameters stay frozen, so only about 131 million projection parameters are tuned, which the paper identifies as the reason the approach trains in reasonable time and GPU memory.

What would settle it

Train ETooL on one major version of an application and evaluate it zero-shot on the next version whose network implementation has been substantially rewritten, for instance switching from HTTP/2 to QUIC or changing connection-pooling behavior; if its F1 drops to the level of the best single-flow baseline rather than degrading only mildly, the claim that BURST graphs are transferable across version shifts is falsified. A complementary check is to shuffle the order of flows inside each BURST while preserving all marginal flow statistics; if accuracy stays high, graph topology is not carrying the improvement.

Watch

Extended reading notes

Core claim

On the paper's own terms, ETooL's discovery is that flow interaction topology is the transferable signal for encrypted traffic classification under distribution shift. The TRG represents each flow as a node carrying a raw datagram byte-pair sequence and a directed packet-size sequence, with burst edges linking flows that start within the time threshold γ and adjacency edges linking consecutive BURST structures. A two-stage instruction-tuning procedure teaches a 7-billion-parameter LLM to read these graphs: first, contrastive learning aligns the graph encoder's representations with flow encodings, and a self-supervised BURST graph matching task asks the model to reorder shuffled BURST features by graph topology; second, task-specific instructions fine-tune only the projection layer while both the LLM and graph encoder remain frozen. In the evaluation, ETooL holds F1 at 93.19% and 92.11% on the same-distribution APP53 tasks and at 74.88% and 72.13% on the time-shift and version-shift tasks, while reaching 95.03% and 81.95% on binary and multi-class ISCX-Botnet detection; the improvements over the best baselines in the shifted settings are 18.17, 15.15, 9.16, and 12.08 F1 points respectively.

Load-bearing premise

The load-bearing premise is that flow-level BURST structure, meaning the pattern of which flows start within about one second of each other, stays similar enough when an application updates, when time passes, or when a new botnet type appears that the Traffic Relation Graph built from it means the same thing in the new distribution as in the training distribution.

Editorial extensions

If this is right

  • In the APP53 time-shift and version-shift tasks, ETooL shows the smallest performance degradation among all compared methods, with average F1 improvements of 16.66%, 29.79%, and 33.42% over representative baselines.
  • On ISCX-Botnet, the same model detects traffic from botnet types never seen in training, reaching 95.03% F1 binary and 81.95% multi-class, beating the strongest baseline by 9.16 and 12.08 points.
  • Because the LLM and graph encoder are frozen, tuned parameters drop by more than 50 times compared with full-parameter LLM fine-tuning, making a 7-billion-parameter instruction-tuned classifier practical on one 80 GB GPU.
  • The generalization is zero-shot with respect to the shifted distribution: task tuning is done only on source-distribution data, and the shifted data is classified without retraining or relabeling.
  • The new NETD dataset, built by controlling proportional and compositional bias inside ISCX-VPN, positions the method to be stress-tested under adjustable degrees of distribution shift rather than only on fixed splits.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the same BURST-graph recipe could be carried to protocols and settings the paper did not test, such as QUIC traffic or non-mobile platforms, because the claimed invariant is flow interaction topology rather than app-specific bytes.
  • Editorial inference: the central role of γ means deliberate jittering of flow start times by a network middlebox or adversary could break the claimed invariance; measuring ETooL under such timing perturbation would probe the mechanism directly.
  • Editorial inference: the self-supervised BURST graph matching task is a general pattern, and any domain with recurring co-occurrence structure could be instruction-tuned into an LLM the same way, using unlabeled graph structure instead of task labels.
  • Editorial inference: the reported gains are averaged against several baselines, and a controlled comparison that matches model size and input length against the strongest baseline, while ablating the graph structure, would isolate how much of the improvement comes from the graph representation itself.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper presents ETooL, a two-stage instruction-tuning framework that combines a traffic relation graph (TRG) built from flow-level BURST structures with a frozen Vicuna-7B LLM and a frozen graph encoder, training only a projection layer and a task head. The first tuning stage is a self-supervised BURST graph matching task, and the second is task-specific instruction tuning. The authors evaluate ETooL on APP53 I.I.D./O.O.D., ISCX-Botnet, and a newly constructed NETD dataset, reporting large F1 gains over statistical, deep-learning, and pre-trained baselines, plus ablation, efficiency, and hyperparameter-sensitivity studies. They also document label-correction decisions for APP53 and ISCX-Botnet.

Significance. If the reported results are robust, the paper would make a useful contribution: it demonstrates a concrete way to inject domain-specific graph structure into an LLM through instruction tuning with a small trainable parameter budget, and it is one of few works explicitly targeting non-I.I.D. encrypted traffic with a tunable O.O.D. dataset. The candid reporting of label inconsistencies, the OOM comparison in Table VII, and the explicit statement that the BURST threshold and learning rate were chosen by testing performance are transparency strengths. However, the central invariance claim—that TRG/BURST structure survives time and version shifts—is not directly validated, and the current evidence relies on test-selected hyperparameters and single-run numbers. These issues are fixable but load-bearing for the headline O.O.D. results.

major comments (4)
  1. [Section VIII-F, Algorithm 1, Table VI] The BURST time threshold gamma is load-bearing: removing graph structural tuning reduces average F1 by 22.13 points (Table VI, model 3), yet Section VIII-F states that gamma was chosen after 'observing the testing performance' on the target I.I.D. and O.O.D. tasks, and the learning rate is selected in the same way. No held-out validation split or target-free selection rule is described. If gamma and the learning rate were tuned against the same target distributions on which ETooL is then evaluated, part of the observed O.O.D. invariance could reflect selection on test data rather than a property of BURST structure, and the comparison would be unfair to baselines that did not receive such tuning. Please specify a validation protocol that does not use target test labels (e.g., source-only validation or a fixed domain-motivated gamma), or report how much of the gains survive under a target-free choice.
  2. [Section VIII-B, Tables IV and V] All reported AC/PR/RC/F1 numbers appear to come from a single run with no error bars, confidence intervals, or multiple seeds. The headline claims (16.66%, 29.79%, and 33.42% average F1 improvements in Section VIII-B.2, and the 9.16% and 12.08% gains on ISCX-Botnet) are differences between single runs; without variance estimates it is unclear whether the gaps are beyond training noise, especially for smaller-margin comparisons such as the I.I.D. results against ET-BERT. Please report means and standard deviations over at least three seeds and, where possible, a paired significance test.
  3. [Section VIII-A2, Table III] The paper corrects the APP53 label set from 22 to 25 classes and supplements two botnet classes in ISCX-Botnet multi-class, which changes the benchmark relative to the original FDAN-APP53 and ISCX-Botnet releases. If baselines were not re-tuned on the corrected label sets, their reported numbers may be lower than what those methods would achieve on the corrected data, inflating ETooL's relative gains. Please state explicitly whether all baselines were re-trained and re-tuned on the same corrected splits, and report the number of label-mapping changes per dataset.
  4. [Section VIII-D, Figure 4] The NETD generalization claims are supported only by a figure with no numerical table, no error bars, and no statistical test; the figure is also hard to read because labels appear as corrupted or unicode strings. Please add a table with exact F1 and accuracy values for all methods on NETD-1 through NETD-4, including variance, so the claim that ETooL 'significantly outperforms' other methods can be verified.
minor comments (6)
  1. [Section VIII-F] The first paragraph states that a too-small BURST time threshold aggregates flows serving different functionalities; this appears to be the opposite of the mechanism described, since a too-small threshold should split BURSTs rather than merge them. Please correct or rephrase.
  2. [Section VI-A, Eqs. (3)-(4)] The contrastive loss uses a similarity matrix and a target y described as a vector; please clarify the dimensions, the role of the temperature coefficient tau, and what constitutes positive and negative pairs in this alignment.
  3. [Algorithm 1, lines 9-15] The edge-insertion procedure is hard to follow from the pseudocode alone; please add a textual step-by-step explanation of how burst edges and adjacency edges are formed, including how isolated flows are handled.
  4. [Table VII] The table contains placeholder or unicode strings in several rows and an incomplete latency entry; please regenerate the table cleanly.
  5. [Figure 5] The axis labels and legends contain unicode escape sequences (e.g., '/uni0000002f/...'); please replace them with proper labels such as 'BURST Time Threshold' and 'Learning Rate'.
  6. [Abstract and Section VIII-A2] The abstract reports significant F1 improvements without mentioning that the APP53 label set was corrected and that NETD is private; please add a reproducibility statement in the experimental settings specifying data availability and label versions.

Circularity Check

1 steps flagged · score 2.0 of 10

Mild evaluation circularity: the BURST graph threshold is selected on the target test performance that is then reported as the O.O.D. prediction; the core derivation is otherwise not circular.

  1. fitted input called prediction [Section VIII-F (Hyper-parameters Analysis), with the threshold fixed in Section VIII-A5]
    "To evaluate this effect, we experimented with a range of time thresholds and observed the testing performance. Empirically, a threshold of around 1 second yielded the most favorable results."

    The BURST time threshold gamma controls the TRG graph structure (Algorithm 1) and is load-bearing: removing graph structural tuning costs 22.13 F1 points on average (Table VI). Section VIII-A5 fixes gamma = 1s, and Section VIII-F reports that this value was chosen by observing testing performance on the target I.I.D./O.O.D. scenarios. The headline O.O.D. F1 scores in Tables IV and V are measured on those same testing sets after gamma was selected to make them favorable. The reported "generalization" numbers are therefore partly in-sample with respect to the graph-construction hyperparameter, rather than an independent evaluation of BURST stability across shifts. This is a mild evaluation circularity, not a derivation-level equivalence.

full rationale

The paper is an empirical method paper; there is no equation-level derivation in which a fitted variable is renamed as a prediction. The TRG graph is constructed from raw flow timestamps and packet/datagram features, the alignment and instruction-tuning losses (Eqs. 2-5) are standard contrastive/CE objectives, and the comparisons and ablations are self-contained against external baselines. The main circularity signal is concentrated in hyperparameter selection: gamma is chosen by testing performance on the same target distributions later reported as O.O.D. gains, and the graph component is essential to the method. That contaminates the magnitude of the claimed robustness but does not make the central method equivalent to its inputs. No load-bearing self-citation or imported uniqueness claim was found; the citations to prior same-group work (ET-BERT, FRG) provide real external context. Score 2 reflects one mild fitted-selection issue with otherwise independent content.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

No scientific constants are derived. The main hand-set quantity is the BURST threshold, tuned on test data. The framework relies on domain assumptions about traffic stability and label correctness, and does not introduce new physical entities.

free parameters (2)
  • BURST time threshold gamma = 1 s
    Controls which flows are grouped into BURST structures; selected empirically in Section VIII-F after evaluating test performance over a range.
  • Learning rate = 2e-3
    Selected in Section VIII-F based on best test performance; other settings (batch size 2, 3 epochs, warmup 0.03) are standard training choices.
assumptions (4)
  • domain assumption Flow-level BURST structures are stable over time and application-version shifts
    The graph representation in Sections V-VI depends on BURST groupings remaining informative across distributions; ablation Model 3 shows the graph is load-bearing.
  • domain assumption A frozen Vicuna-7B can learn traffic graph semantics through a small trained projection layer
    The tuning strategy in Sections VI-B and VII freezes the entire LLM and graph encoder, so all transfer must happen through the projector.
  • domain assumption The corrected labels for APP53 and ISCX-Botnet are accurate
    The Notes in Section VIII-A1 state that the authors detected labeling inconsistencies, changed the category count from 22 to 25, and supplemented two botnet classes; the reported scores assume these corrections are right.
  • domain assumption The NI index based on ET-BERT features is a valid measure of distribution shift
    Used in Section VIII-A1 to motivate NETD; the model's validity is assumed, not proven.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Respond to Change with Constancy: Instruction-tuning with LLM for Non-I.I.D. Network Traffic Classification." pith.science (2026). https://pith.science/paper/NQZPIYZ6

@misc{pith2026250520866,
  author       = {Pith},
  title        = {Pith review of: Respond to Change with Constancy: Instruction-tuning with LLM for Non-I.I.D. Network Traffic Classification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NQZPIYZ6}},
  note         = {Machine review of arXiv:2505.20866}
}
read the original abstract

Encrypted traffic classification is highly challenging in network security due to the need for extracting robust features from content-agnostic traffic data. Existing approaches face critical issues: (i) Distribution drift, caused by reliance on the closedworld assumption, limits adaptability to realworld, shifting patterns; (ii) Dependence on labeled data restricts applicability where such data is scarce or unavailable. Large language models (LLMs) have demonstrated remarkable potential in offering generalizable solutions across a wide range of tasks, achieving notable success in various specialized fields. However, their effectiveness in traffic analysis remains constrained by challenges in adapting to the unique requirements of the traffic domain. In this paper, we introduce a novel traffic representation model named Encrypted Traffic Out-of-Distribution Instruction Tuning with LLM (ETooL), which integrates LLMs with knowledge of traffic structures through a self-supervised instruction tuning paradigm. This framework establishes connections between textual information and traffic interactions. ETooL demonstrates more robust classification performance and superior generalization in both supervised and zero-shot traffic classification tasks. Notably, it achieves significant improvements in F1 scores: APP53 (I.I.D.) to 93.19%(6.62%) and 92.11%(4.19%), APP53 (O.O.D.) to 74.88%(18.17%) and 72.13%(15.15%), and ISCX-Botnet (O.O.D.) to 95.03%(9.16%) and 81.95%(12.08%). Additionally, we construct NETD, a traffic dataset designed to support dynamic distributional shifts, and use it to validate ETooL's effectiveness under varying distributional conditions. Furthermore, we evaluate the efficiency gains achieved through ETooL's instruction tuning approach.

Figures

Figures reproduced from arXiv: 2505.20866 by the authors.

Figure 1
Figure 1. The Schematic Illustration of Different O.O.D. Identification Solutions. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of ETooL Framework. LLMs capture and learn flow associations, thus alleviating problems such as the difficulty of existing LLMs in under￾standing flow feature information and flow-graph structure. In particular, the flow-graph alignment module aims to align the flow features and topological relationship graphs in the encoding space, based on which natural language instruction data containing flow feature in… view at source ↗
Figure 3
Figure 3. Comparison of the Index of Distribution Shift and Testing Error. [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Comparison Results on Dynamic Non-I.I.D. Encrypted Traffic Dataset. [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Comparison Results on Different Hyper-parameters Selection. [PITH_FULL_IMAGE:figures/full_fig_p014_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

52 extracted references · 51 canonical work pages

  1. [1]

    Deep learning for encrypted traffic classification: An overview,

    S. Rezaei and X. Liu, “Deep learning for encrypted traffic classification: An overview,”IEEE Commun. Mag., vol. 57, no. 5, pp. 76–81, 2019

    work page 2019

  2. [2]

    Realtime robust malicious traffic detection via frequency domain analysis,

    C. Fu, Q. Li, M. Shen, and K. Xu, “Realtime robust malicious traffic detection via frequency domain analysis,” inCCS ’21: 2021 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, Republic of Korea, November 15 - 19, 2021, Y . Kim, J. Kim, G. Vigna, and E. Shi, Eds. ACM, 2021, pp. 3431–3446

    work page 2021

  3. [3]

    An in- depth study of microservice call graph and runtime performance,

    S. Luo, H. Xu, C. Lu, K. Ye, G. Xu, L. Zhang, J. He, and C. Xu, “An in- depth study of microservice call graph and runtime performance,”IEEE Trans. Parallel Distributed Syst., vol. 33, no. 12, pp. 3901–3914, 2022

    work page 2022

  4. [4]

    Multi-tier workload consolidations in the cloud: Profiling, modeling and optimization,

    K. Ye, H. Shen, Y . Wang, and C. Xu, “Multi-tier workload consolidations in the cloud: Profiling, modeling and optimization,”IEEE Trans. Cloud Comput., vol. 10, no. 2, pp. 899–912, 2022

    work page 2022

  5. [5]

    & Wang, Y

    Yuan, Q., Gou, G., Zhu, Y ., Zhu, Y ., Xiong, G. & Wang, Y . MCRe: A Unified Framework for Handling Malicious Traffic With Noise Labels Based on Multidimensional Constraint Representation.IEEE Trans. Inf. Forensics Secur..19pp. 133-147 (2024)

    work page 2024

  6. [6]

    Machine learning for encrypted malware traffic classification: Accounting for noisy labels and non- stationarity,

    B. Anderson and D. A. McGrew, “Machine learning for encrypted malware traffic classification: Accounting for noisy labels and non- stationarity,” inProceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Halifax, NS, Canada, August 13 - 17, 2017. ACM, 2017, pp. 1723–1732

    work page 2017

  7. [7]

    Shen, M., Zhang, J., Zhu, L., Xu, K. & Du, X. Accurate Decentralized Application Identification via Encrypted Traffic Analysis Using Graph Neural Networks.IEEE Trans. Inf. Forensics Secur.. vol.16 pp. 2367- 2380 (2021)

    work page 2021

  8. [8]

    Sirinam, P., Imani, M., Ju ´arez, M. & Al. Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning. Proceedings Of The 2018 ACM SIGSAC Conference On Computer And Communications Security, CCS 2018, Toronto, ON, Canada, October 15-

    work page 2018

Show all 52 references
  1. [9]

    & Grundy, J

    Liu, P., Li, L., Yan, Y ., Fazzini, M. & Grundy, J. Identifying and Characterizing Silently-Evolved Methods in the Android API.43rd IEEE/ACM International Conference On Software Engineering: Software Engineering In Practice, ICSE (SEIP) 2021, Madrid, Spain, May 25-28,

    2021

  2. [10]

    & Tuffin, B

    Gourdin, Maill ´e, P., Simon, G. & Tuffin, B. The Economics of CDNs and Their Impact on Service Fairness.IEEE Trans. Netw. Serv. Manag.. 14, 22-33 (2017)

    2017

  3. [11]

    Mobile cdn market — global industry report

    Market, M. Mobile cdn market — global industry report. (2020), https://www.transparencymarketresearch.com/mobile-cdn-market.html

    2020

  4. [12]

    ET-BERT: A contextualized datagram representation with pre-training transformers for encrypted traffic classification,

    X. Lin, G. Xiong, G. Gou, Z. Li, J. Shi, and J. Yu, “ET-BERT: A contextualized datagram representation with pre-training transformers for encrypted traffic classification,” inWWW ’22: The ACM Web Conference 2022, Virtual Event, Lyon, France, April 25 - 29, 2022, F. Laforest, R...

    2022

  5. [13]

    Cui, T., Lin, X., Li, S., Chen, M., Yin, Q., Li, Q. & Xu, K. TrafficLLM: Enhancing Large Language Models for Network Traffic Analysis with Generic Traffic Representation.ArXiv. (2025)

    2025

  6. [14]

    & Joosen, W

    Rimmer, V ., Preuveneers, D., Juarez, M., Goethem, T. & Joosen, W. Automated Website Fingerprinting through Deep Learning.25th Annual Network And Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018. (2018) JOURNAL OF LATEX CLASS F...

    2018

  7. [15]

    Website fingerprinting at internet scale,

    A. Panchenko, F. Lanze, J. Pennekamp, T. Engel, A. Zinnen, M. Henze, and K. Wehrle, “Website fingerprinting at internet scale,” in23rd Annual Network and Distributed System Security Symposium, NDSS, San Diego, California, USA, February 21-24, 2016. The Internet Society, 2016

    2016

  8. [16]

    & Zhang, Y

    Tian, Y ., Gan, R., Song, Y ., Zhang, J. & Zhang, Y . ChiMed-GPT: A Chinese Medical Large Language Model with Full Training Regime and Better Alignment to Human Preferences.Proceedings Of The 62nd Annual Meeting Of The Association For Computational Linguistics (Volume 1: Long ...

    2024

  9. [17]

    & Ananiadou, S

    Yang, K., Zhang, T., Kuang, Z., Xie, Q., Huang, J. & Ananiadou, S. MentaLLaMA: Interpretable Mental Health Analysis on Social Media with Large Language Models.Proceedings Of The ACM On Web Conference 2024, WWW 2024, Singapore, May 13-17, 2024. pp. 4489- 4500 (2024)

    2024

  10. [18]

    TSCRNN: A novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of iiot,

    K. Lin, X. Xu, and H. Gao, “TSCRNN: A novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of iiot,”Comput. Networks, vol. 190, p. 107974, 2021

    2021

  11. [19]

    1928-1943 (2018)

    pp. 1928-1943 (2018)

    2018

  12. [20]

    Malware traffic classification using convolutional neural network for representation learning,

    W. Wang, M. Zhu, X. Zeng, X. Ye, and Y . Sheng, “Malware traffic classification using convolutional neural network for representation learning,” in2017 International Conference on Information Networking, ICOIN, Da Nang, Vietnam, January 11-13, 2017. IEEE, pp. 712–717

    2017

  13. [21]

    Deep packet: a novel approach for encrypted traffic classification using deep learning,

    M. Lotfollahi, M. J. Siavoshani, R. S. H. Zade, and M. Saberian, “Deep packet: a novel approach for encrypted traffic classification using deep learning,”Soft Comput., vol. 24, no. 3, pp. 1999–2012, 2020

    1999

  14. [22]

    Fs-net: A flow sequence network for encrypted traffic classification,

    C. Liu, L. He, G. Xiong, Z. Cao, and Z. Li, “Fs-net: A flow sequence network for encrypted traffic classification,” in2019 IEEE Conference on Computer Communications, INFOCOM 2019, Paris, France, April 29 - May 2, 2019. IEEE, 2019, pp. 1171–1179

    2019

  15. [23]

    & Fedus, W

    Wei, J., Tay, Y ., Bommasani, R., Raffel, C., Zoph, B., Borgeaud, S., Yogatama, D., Bosma, M., Zhou, D., Metzler, D., Chi, E., Hashimoto, T., Vinyals, O., Liang, P., Dean, J. & Fedus, W. Emergent Abilities of Large Language Models.Trans. Mach. Learn. Res..2022(2022)

    2022

  16. [24]

    PERT: payload encoding representation from transformer for encrypted traffic classification,

    H. Y . He, Z. G. Yang, and X. N. Chen, “PERT: payload encoding representation from transformer for encrypted traffic classification,” in2020 ITU Kaleidoscope: Industry-Driven Digital Transformation, Kaleidoscope, Ha Noi, Vietnam, December 7-11, 2020. , pp. 1–8

    2020

  17. [25]

    & Konan, M

    Liu, C., Wang, W., Wang, M., Lv, F. & Konan, M. An efficient instance selection algorithm to reconstruct training set for support vector machine. Knowl. Based Syst..116pp. 58-73 (2017)

    2017

  18. [26]

    & Huang, C

    Tang, J., Yang, Y ., Wei, W., Shi, L., Su, L., Cheng, S., Yin, D. & Huang, C. GraphGPT: Graph Instruction Tuning for Large Language Models.Proceedings Of The 47th International ACM SIGIR Conference On Research And Development In Information Retrieval, SIGIR 2024, Washington DC...

    2024

  19. [27]

    Unbiased look at dataset bias,

    A. Torralba and A. A. Efros, “Unbiased look at dataset bias,” inThe 24th IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2011, Colorado Springs, CO, USA, 20-25 June 2011. IEEE Computer Society, 2011, pp. 1521–1528

    2011

  20. [28]

    Characterization of tor traffic using time based features,

    A. H. Lashkari, G. Draper-Gil, M. S. I. Mamun, and A. A. Ghorbani, “Characterization of tor traffic using time based features,” inProceedings of the 3rd International Conference on Information Systems Security and Privacy, ICISSP 2017, Porto, Portugal, February 19-21, 2017, P....

    2017

  21. [29]

    Towards effective feature selection in machine learning-based botnet detection approaches,

    E. B. B. Samani, H. H. Jazi, N. Stakhanova, and A. A. Ghorbani, “Towards effective feature selection in machine learning-based botnet detection approaches,” inIEEE Conference on Communications and Network Security, CNS 2014, San Francisco, CA, USA, October 29-31,

    2014

  22. [30]

    & Xiong, G

    Lin, X., He, L., Gou, G., Yu, J., Guan, Z., Li, X., Guo, J. & Xiong, G. CETP: A novel semi-supervised framework based on contrastive pre- training for imbalanced encrypted traffic classification.Comput. Secur.. 143pp. 103892 (2024)

    2024

  23. [31]

    Zero-relabelling mobile-app identification over drifted encrypted network traffic,

    M. Jiang, M. Cui, C. Liu, G. Gou, G. Xiong, and Z. Li, “Zero-relabelling mobile-app identification over drifted encrypted network traffic,”Comput. Networks, vol. 228, p. 109728, 2023

    2023

  24. [32]

    Characterization of encrypted and VPN traffic using time- related features,

    G. Draper-Gil, A. H. Lashkari, M. S. I. Mamun, and A. A. Ghorbani, “Characterization of encrypted and VPN traffic using time- related features,” inProceedings of the 2nd International Conference on Information Systems Security and Privacy, ICISSP 2016, Rome, Italy, February 19...

    2016

  25. [33]

    Towards non-i.i.d. image classification: A dataset and baselines,

    Y . He, Z. Shen, and P. Cui, “Towards non-i.i.d. image classification: A dataset and baselines,”Pattern Recognit., vol. 110, p. 107383, 2021

    2021

  26. [34]

    Optimizing feature selection for efficient encrypted traffic classification: A systematic approach,

    M. Shen, Y . Liu, L. Zhu, K. Xu, X. Du, and N. Guizani, “Optimizing feature selection for efficient encrypted traffic classification: A systematic approach,”IEEE Netw., vol. 34, no. 4, pp. 20–27, 2020

    2020

  27. [35]

    Flowprint: Semi-supervised mobile-app fingerprinting on encrypted network traffic,

    T. van Ede, R. Bortolameotti, A. Continella, J. Ren, D. J. Dubois, M. Lindorfer, D. R. Choffnes, M. van Steen, and A. Peter, “Flowprint: Semi-supervised mobile-app fingerprinting on encrypted network traffic,” in27th Annual Network and Distributed System Security Symposium, ND...

    2020

  28. [36]

    & Greenstadt, R

    Juarez, M., Afroz, S., Acar, G., Dıaz, C. & Greenstadt, R. A Critical Evaluation of Website Fingerprinting Attacks.Proceedings Of The 2014 ACM SIGSAC Conference On Computer And Communications Security, Scottsdale, AZ, USA, November 3-7, 2014. pp. 263-274 (2014)

    2014

  29. [37]

    Adawfpa: Adaptive online website fingerprinting attack for tor anonymous network: A stream-wise paradigm,

    R. Attarian, L. Abdi, and S. Hashemi, “Adawfpa: Adaptive online website fingerprinting attack for tor anonymous network: A stream-wise paradigm,”Comput. Commun., vol. 148, pp. 74–85, 2019

    2019

  30. [38]

    Language models as knowledge bases?

    F. Petroni, T. Rockt ¨aschel, S. Riedel, P. S. H. Lewis, A. Bakhtin, Y . Wu, and A. H. Miller, “Language models as knowledge bases?” inProceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural L...

    2019

  31. [39]

    Robust smartphone app identification via encrypted network traffic analysis,

    V . F. Taylor, R. Spolaor, M. Conti, and I. Martinovic, “Robust smartphone app identification via encrypted network traffic analysis,” IEEE Trans. Inf. Forensics Secur., vol. 13, no. 1, pp. 63–78, 2018

    2018

  32. [40]

    Accurate mobile-app fingerprinting using flow-level relationship with graph neural networks,

    M. Jiang, Z. Li, P. Fu, W. Cai, M. Cui, G. Xiong, and G. Gou, “Accurate mobile-app fingerprinting using flow-level relationship with graph neural networks,”Comput. Networks, vol. 217, p. 109309, 2022

    2022

  33. [41]

    Adaptive encrypted traffic fingerprinting with bi-directional dependence,

    K. Al-Naami, S. Chandra, A. M. Mustafa, L. Khan, Z. Lin, K. W. Hamlen, and B. Thuraisingham, “Adaptive encrypted traffic fingerprinting with bi-directional dependence,” inProceedings of the 32nd Annual Conference on Computer Security Applications, ACSAC 2016, Los Angeles, CA, ...

    2016

  34. [42]

    Learning to prompt for vision-language models,

    K. Zhou, J. Yang, C. C. Loy, and Z. Liu, “Learning to prompt for vision-language models,”Int. J. Comput. Vis., vol.130, no.9, pp. 2337- 2348, 2022

    2022

  35. [43]

    Transfg: A transformer architecture for fine-grained recognition,

    J. He, J. Chen, S. Liu, A. Kortylewski, C. Yang, Y . Bai, and C. Wang, “Transfg: A transformer architecture for fine-grained recognition,” in Thirty-Sixth AAAI Conference on Artificial Intelligence, AAAI 2022, Thirty-Fourth Conference on Innovative Applications of Artificial I...

    2022

  36. [44]

    & Xiong, G

    Wang, X., Yuan, Q., Wang, Y ., Gou, G., Gu, C., Yu, G. & Xiong, G. Combine intra- and inter-flow: A multimodal encrypted traffic classification model driven by diverse features.Comput. Networks.245 pp. 110403 (2024)

    2024

  37. [45]

    Mt-flowformer: A semi-supervised flow transformer for encrypted traffic classification,

    R. Zhao, X. Deng, Z. Yan, J. Ma, Z. Xue, and Y . Wang, “Mt-flowformer: A semi-supervised flow transformer for encrypted traffic classification,” in KDD ’22: The 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Washington, DC, USA, August 14 - 18, 2022, A. Zha...

    2022

  38. [46]

    & Xie, Y

    Hang, Z., Lu, Y ., Wang, Y . & Xie, Y . Flow-MAE: Leveraging Masked AutoEncoder for Accurate, Efficient and Robust Malicious Traffic Classification.Proceedings Of The 26th International Symposium On Research In Attacks, Intrusions And Defenses, RAID 2023, Hong Kong, China, Oct...

    2023

  39. [47]

    How can we know what language models know,

    Wu, D., Wang, X., Qiao, Y ., Wang, Z., Jiang, J., Cui, S. & Wang, F. NetLLM: Adapting Large Language Models for Networking.Proceedings Of The ACM SIGCOMM 2024 Conference, ACM SIGCOMM 2024, Sydney, NSW, Australia, August 4-8, 2024. pp. 661-678 (2024) Z. Jiang, F. F. Xu, J. Arak...

    2024

  40. [48]

    & Han, J

    Jin, B., Liu, G., Han, C., Jiang, M., Ji, H. & Han, J. Large Language Models on Graphs: A Comprehensive Survey.IEEE Trans. Knowl. Data Eng..36, 8622-8642 (2024)

    2024

  41. [49]

    & Liu, Y

    Han, D., Wang, Z., Feng, R., Jin, M., Chen, W., Wang, K., Wang, S., Yang, J., Shi, X., Yin, X. & Liu, Y . Rules Refine the Riddle: Global Explanation for Deep Learning-Based Anomaly Detection in Security Applications.Proceedings Of The 2024 On ACM SIGSAC Conference On Computer...

    2024

  42. [50]

    & Hajishirzi, H

    Wang, Y ., Kordi, Y ., Mishra, S., Liu, A., Smith, N., Khashabi, D. & Hajishirzi, H. Self-Instruct: Aligning Language Models with Self- Generated Instructions.Proceedings Of The 61st Annual Meeting Of The Association For Computational Linguistics (Volume 1: Long Papers), ACL 2...

    2023

  43. [2014]

    IEEE, 2014, pp. 247–255

    2014

  44. [2024]

    7156-7173 (2024)

    pp. 7156-7173 (2024)

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.