Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

When Simple Model Just Works: Is Network Traffic Classification in Crisis?

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Duplicates make a simple k-NN match deep traffic classifiers

desk verdict A systematic, field-relevant demonstration that TC dataset redundancy inflates baseline performance under random splits, though the causal mechanism is not fully pinned down. read the letter →

arxiv 2506.08655 v1 pith:CKJRAMNB submitted 2025-06-10 cs.LG cs.NI

Kamil Jerabek , Jan Luxemburk , Richard Plny , Josef Koumar , Jaroslav Pesek , Karel Hynek This is my paper
classification cs.LGcs.NI
keywords networktrafficclassificationk-NNbaselinedatasetredundancymaximumachievableaccuracyevaluationprotocolencrypteddeeplearningtime-basedsplit
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the surprising success of a simple k-NN baseline in network traffic classification is not a fluke but a symptom of the datasets themselves. Across 12 datasets and 15 tasks, a classifier that compares raw packet sequences (sizes, inter-packet times, directions) matches or beats much more complex deep learning models, on average coming within 2.88 percentage points of state-of-the-art and beating it in two cases. The authors show the reason: most traffic datasets are saturated with exact duplicates, with over 50% of samples redundant in more than half of the datasets, and random train/test splits place the same flows on both sides of the evaluation. This inflates accuracy, masks generalisation difficulty, and, because identical sequences sometimes carry conflicting labels, caps the maximum achievable accuracy below 100%. The paper proposes a metric for that upper bound and concludes that several popular intrusion-detection benchmarks are already effectively solved by the baseline.

What carries the argument

The input-space baseline and the maximum achievable accuracy metric carry the argument. The baseline is k-NN with L1 distance over a feature vector of packet sizes, inter-packet times (clipped and scaled), and directions (+-1) for the first N packets, with four hyperparameters tuned per dataset by the Optuna framework. The metric, defined in Eq. 1, is the accuracy of a hypothetical perfect classifier that correctly labels all unique samples and all same-class duplicates, and assigns each conflicting duplicate cluster its majority class; it is the best any model can do on that dataset structure. This machinery converts the observation that datasets contain duplicates into a measurable ceiling, and the near-zero gap between the baseline and that ceiling for several datasets is what supports the paper's claim that those tasks are already solved.

What would settle it

On a dataset the paper calls effectively solved, such as CIC-IDS-2017, remove every test sample whose packet sequence has an identical copy in the training set and measure the baseline accuracy on the remaining unique test samples; if accuracy stays near the reported 99%, duplicate overlap is not the main cause, and if it collapses, the duplication argument is confirmed.

Watch

Extended reading notes

Core claim

A k-NN classifier that uses L1 distance on raw packet metadata (sizes, inter-packet times in milliseconds, and directions encoded as +-1 for the first N up to 30 payload packets) matches or outperforms state-of-the-art deep learning methods on most of the 12 datasets examined. The paper establishes that this strong performance is largely driven by extreme data redundancy: more than half of the samples in most datasets are exact duplicates of other samples, and identical packet sequences frequently appear in both training and test sets under common random-splitting practices. Identical sequences with conflicting class labels also appear throughout the datasets, making perfect classification impossible and reducing the theoretical maximum accuracy. The paper defines the maximum achievable accuracy metric to make this conflict explicit, and shows that for three IDS datasets, CIC-DoHBrw, CIC-IDS-2017, and EdgeIIoTset, the baseline performs within 0.15% of the bound, meaning those tasks are effectively solved and unsuitable for benchmarking future research.

Load-bearing premise

The maximum achievable accuracy metric assumes a perfect model exists that can label every unique sample correctly from the training data, which may be optimistic when the test set comes from a different time period or a different environment.

Editorial extensions

If this is right

  • Random splitting should be abandoned in favour of time-based or disjoint-entity splits, since random splits can inflate reported accuracy by at least 3.5 percentage points on CESNET-QUIC22.
  • New traffic-classification methods should be compared against the input-space k-NN baseline; methods that cannot beat it meaningfully offer illusory progress.
  • CIC-IDS-2017, CIC-DoHBrw, and EdgeIIoTset, where the baseline is within 0.15% of the maximum achievable accuracy, should not be used as benchmarks for future research.
  • Because identical flows with conflicting labels are common in intrusion-detection data, the estimated minimal false positive rate is 2.65% for UNSW-NB15 and 9.12% for CIC-IDS-2017, limiting real-world deployment regardless of model choice.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the redundancy thesis holds broadly, recent accuracy gains reported across the traffic-classification literature may largely reflect memorisation; re-evaluating methods on deduplicated, time-split data would be a cheap and decisive test.
  • The same duplication phenomenon likely applies to other sequence-based network tasks dominated by short protocol exchanges, such as DNS-over-HTTPS detection, where the maximum-achievable-accuracy bound could be computed in the same way.
  • The paper's diagnosis implies that data augmentation that deliberately breaks exact duplicates, such as timing jitter or TCP-aware packet edits, may be a more productive direction than new architectures.
  • A practical prescription follows for dataset authors: publish duplicate fractions and conflicting-cluster fractions alongside their data, so users can calibrate how much of a task is memorisation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper evaluates a simple k-NN baseline that classifies traffic from raw packet-sequence metadata (sizes, inter-packet times, directions) across 12 datasets and 15 traffic-classification tasks, and compares it against published state-of-the-art results. The main finding is that the baseline is competitive with or better than more complex models on many tasks. The authors attribute this to massive redundancy in TC datasets: more than half of the samples in most datasets are exact duplicates, and random splits place identical samples in both training and test sets. They also define a 'maximum achievable accuracy' metric that accounts for duplicate clusters with conflicting labels, and they argue that several IDS tasks are effectively solved by the baseline. The paper concludes by recommending time-based or disjoint splits and the routine use of a simple baseline as a sanity check.

Significance. If the redundancy claim is established, this is an important field-level result: it challenges the validity of many existing TC benchmarks, explains why simple baselines match complex neural models, and offers concrete evaluation-protocol recommendations. The paper's strengths are its broad dataset coverage, the use of the tcbench framework for curated data, direct demonstrations of split-dependent effects on two datasets (CIC-DoHBrw disjoint split, CESNET-QUIC22 time split), and a clear, simple metric (Eq. 1). The Spearman correlation test is appropriate for the exploratory claim, and the recommendations are actionable. However, the central causal claim is not fully supported by direct measurement, and some secondary analyses (the FPR estimate, the SOTA deltas) need tightening.

major comments (4)
  1. [§4.1, Fig. 2, and §6] The paper's central causal claim—that the baseline's strong performance is 'largely driven by' redundancy because identical samples appear in both training and test sets—is not directly tested. The only statistical evidence is a Spearman correlation (rho=0.74, p=0.0016) between the overall fraction of duplicate samples and baseline accuracy. A global duplicate rate does not imply that duplicates cross the train/test boundary; they could be concentrated within splits, or separated by time. The direct demonstrations (CIC-DoHBrw disjoint split in Table 7 and CESNET-QUIC22 time-based split in Table 8) cover only two datasets. To make the claim load-bearing, please report per-dataset (per-repetition) train/test exact-match rates for all 15 tasks and correlate those with the accuracy, or soften the conclusion to a hypothesis supported by partial evidence.
  2. [§4.2, Eq. (1), Table 5] The maximum achievable accuracy is an optimistic upper bound: it assumes every unique test sample is perfectly classifiable from the training data and that the majority class can be achieved for every mixed duplicate cluster. The paper acknowledges this for the metric itself, but the 'effectively solved' conclusion (gap smaller than 0.15% for CIC-DoHBrw, CIC-IDS-2017, and EdgeIIoTset) inherits that optimism and is stated without the same qualification. Table 7 demonstrates the point: under a disjoint split, CIC-DoHBrw shows an 18.98 percentage point gap rather than 0.13. Please either qualify the 'effectively solved' claim as applying only under random-split evaluation and compute the bound under the recommended realistic splits, or change the wording.
  3. [Table 6 and footnote 3] The computation of the minimal false positive rate is under-specified. Assigning 'malware' to every mixed cluster yields an FPR equal to the benign share of mixed clusters; this is a lower bound for a model that never misses a malware instance inside a mixed cluster, but it is not a universal lower bound on FPR (a model could, in principle, abstain or use extra features). The text should state this assumption precisely; as written, the phrase 'inevitably cause a high number of false positives' overstates what the measurement establishes.
  4. [§3.6, Table 3, Appendix B] The comparison with state-of-the-art relies on external accuracy/F1 numbers from prior papers that may use different preprocessing, splits, or class definitions. The manuscript states that the authors 'did our best' to replicate, but no reproduction package or per-task preprocessing specification is provided, so readers cannot verify the reported deltas. At minimum, include a supplementary table documenting for each SOTA row the exact split, filtering, and metric used, or limit the 'matches/outperforms SOTA' claims to the datasets where the comparison is apples-to-apples.
minor comments (5)
  1. [Table 3] The column header 'SOTA∆' is ambiguous and the signs are inconsistent across rows (e.g., CESNET-TLS22 shows −4.86 while MIRAGE19 shows +0.72 for what appears to be the same kind of difference); please define the column and use consistent signed arithmetic.
  2. [Table 1] The UCDAVIS19 row has the odd '7k / — / 83 or 150' entry and a 'fixed' split strategy; please clarify the meaning of the dash and the fixed split for this dataset.
  3. [§4.2 (footnote 3)] The footnote marker appears inside the running text as 'we estimate 3 the lower bound', which is malformed; reposition the marker and attach the footnote to the phrase 'minimal FPR'.
  4. [§4.1] The sentence 'We are sure that behind this confirmed correlation is the effect described earlier' is an unsupported expression of certainty; please hedge it to match the correlational evidence actually presented.
  5. [Table 5] For MIRAGE19, MIRAGE22, and UTMOBILENET21, the 'Best Input Space' values are recomputed as accuracy (not F1) and without the short-flow filter, yet they are presented alongside Table 3 results; please explain these differences prominently to avoid confusion.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the input-space baseline is evaluated independently and the redundancy analysis is a post-hoc empirical measurement, not fitted into the claims.

full rationale

The paper's central derivation is empirical rather than definitional. The input-space baseline is a k-NN classifier with L1 distance defined in Sec. 3.1; its performance in Table 3 is measured on held-out test splits after standard Optuna validation tuning, independent of the redundancy statistics in Sec. 4.1. The 'maximum achievable accuracy' metric (Eq. 1) is computed directly from test-set feature multiplicities and labels; it is not fitted to the baseline accuracy, and the comparison in Table 5 is a post-hoc bound rather than a construction of the result. The only statistical link between redundancy and performance is a Spearman correlation (rho=0.74, p=0.0016), which is an empirical association, not an identity imposed by definition. Self-citations exist (e.g., the baseline originates from Luxemburk et al. [1], and several SOTA values come from co-authored papers), but they are not load-bearing: the baseline is re-implemented and re-tuned here, and the redundancy explanation does not depend on accepting any cited result as true. The paper's stronger causal wording ('largely driven by extreme data redundancy') is not directly tested via measured train/test duplicate leakage, and the maximum-accuracy upper bound assumes unique samples are perfectly classifiable; these are evidentiary and assumption concerns, not circularity. Thus no circular step can be exhibited.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The central redundancy analysis has no fitted parameters. The only tuned quantities are the baseline hyperparameters, which are not used in the redundancy metrics. The paper introduces a new metric, maximum achievable accuracy, but that is a definition rather than an invented physical entity. Key assumptions include the feature representation and the reliance on external SOTA results.

free parameters (1)
  • Baseline k-NN hyperparameters per dataset (N, DIR scale, IPT maxclip, IPT scale) = See Table 2, tuned via Optuna on validation data
    These are fitted to optimize baseline performance on validation sets. They are not inputs to the redundancy analysis or the maximum achievable accuracy metric, but they condition the baseline performance numbers used in comparisons.
assumptions (3)
  • domain assumption The packet-sequence feature space (sizes, inter-packet times, directions) is the relevant input representation for traffic classification.
    The redundancy analysis and maximum achievable accuracy are defined over this feature space; other features (e.g., payload) could resolve mixed duplicates, which the paper acknowledges.
  • domain assumption Exact duplicate detection based on equality of raw feature vectors is the appropriate measure of redundancy.
    Near-duplicates caused by small network noise are not counted; the paper considers both with-IPT and without-IPT variants but still uses exact equality.
  • domain assumption SOTA results taken from referenced papers are reliable and comparably measured.
    The comparison in Table 3 depends on reported SOTA numbers; the authors do not re-run the SOTA methods themselves.

how reviews work

0 comments
Cite this review

Pith. "Pith review of When Simple Model Just Works: Is Network Traffic Classification in Crisis?." pith.science (2026). https://pith.science/paper/CKJRAMNB

@misc{pith2026250608655,
  author       = {Pith},
  title        = {Pith review of: When Simple Model Just Works: Is Network Traffic Classification in Crisis?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CKJRAMNB}},
  note         = {Machine review of arXiv:2506.08655}
}
read the original abstract

Machine learning has been applied to network traffic classification (TC) for over two decades. While early efforts used shallow models, the latter 2010s saw a shift toward complex neural networks, often reporting near-perfect accuracy. However, it was recently revealed that a simple k-NN baseline using packet sequences metadata (sizes, times, and directions) can be on par or even outperform more complex methods. In this paper, we investigate this phenomenon further and evaluate this baseline across 12 datasets and 15 TC tasks, and investigate why it performs so well. Our analysis shows that most datasets contain over 50% redundant samples (identical packet sequences), which frequently appear in both training and test sets due to common splitting practices. This redundancy can lead to overestimated model performance and reduce the theoretical maximum accuracy when identical flows have conflicting labels. Given its distinct characteristics, we further argue that standard machine learning practices adapted from domains like NLP or computer vision may be ill-suited for TC. Finally, we propose new directions for task formulation and evaluation to address these challenges and help realign the field.

Figures

Figures reproduced from arXiv: 2506.08655 by the authors.

Figure 1
Figure 1. Fraction of unique sequences of packet lengths and directions [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Fractions of duplicate samples in all datasets. Green bars represent [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. ECDF curves show the fractions of dataset samples, same-class duplications, and mixed-class duplications across different packet sequence [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: All datasets redundancy heatmap without IPT. The color-coded redundancy ratios are calculated across all packet sequences of equal length. Blue [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. FlowCLIP: Contrastive Pretraining Using Domain Names for Encrypted Traffic Classification

    cs.NI 2026-06 unverdicted novelty 6.0 of 10

    FlowCLIP pretrains a traffic encoder via CLIP-style contrastive loss on domain names from side-channel features, then freezes it for linear probing classification that outperforms baselines on later weeks of QUIC traffic.

Reference graph

Works this paper leans on

47 extracted references · 42 canonical work pages · cited by 1 Pith paper

  1. [1]

    Universal em- bedding function for traffic classification via quic domain recog- nition pretraining: A transfer learning success,

    J. Luxemburk, K. Hynek, R. Pln ´y, and T. ˇCejka, “Universal em- bedding function for traffic classification via quic domain recog- nition pretraining: A transfer learning success,”arXiv preprint arXiv:2502.12930, 2025

    work page arXiv 2025

  2. [2]

    A survey of techniques for internet traffic classification using machine learning,

    T. T. Nguyen and G. Armitage, “A survey of techniques for internet traffic classification using machine learning,”IEEE communications surveys & tutorials, vol. 10, no. 4, pp. 56–76, 2009

    work page 2009

  3. [3]

    A comprehensive survey on machine learning for networking: evolution, applications and research opportunities,

    R. Boutaba, M. A. Salahuddin, N. Limam, S. Ayoubi, N. Shahriar, F. Estrada-Solano, and O. M. Caicedo, “A comprehensive survey on machine learning for networking: evolution, applications and research opportunities,”Journal of Internet Services and Applications, vol. 9, no. 1, pp. 1–99, 2018

    work page 2018

  4. [4]

    A preliminary performance comparison of five machine learning algorithms for practical ip traffic flow classification,

    N. Williams, S. Zander, and G. Armitage, “A preliminary performance comparison of five machine learning algorithms for practical ip traffic flow classification,”SIGCOMM Comput. Commun. Rev., vol. 36, no. 5, p. 5–16, Oct. 2006. [Online]. Available: https://doi.org/10.1145/1163593.1163596

    work page arXiv 2006

  5. [5]

    Blinc: multilevel traffic classification in the dark,

    T. Karagiannis, K. Papagiannaki, and M. Faloutsos, “Blinc: multilevel traffic classification in the dark,” inProceedings of the 2005 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, ser. SIGCOMM ’05. New York, NY , USA: Association for Computing Machinery, 2005, p. 229–240. [Online]. Available: https://do...

    doi:10.1145/1080091 2005

  6. [6]

    Wang and S

    K. Wang and S. J. Stolfo,Anomalous Payload-Based Network Intru- sion Detection. Springer Berlin Heidelberg, 2004, p. 203–222

    work page 2004

  7. [7]

    Traffic classification on the fly,

    L. Bernaille, R. Teixeira, I. Akodkenou, A. Soule, and K. Salama- tian, “Traffic classification on the fly,”ACM SIGCOMM Computer Communication Review, vol. 36, no. 2, pp. 23–26, 2006

    work page 2006

  8. [8]

    An analysis of internet chat systems,

    C. Dewes, A. Wichmann, and A. Feldmann, “An analysis of internet chat systems,” inProceedings of the 2003 ACM SIGCOMM conference on Internet measurement - IMC ’03, ser. IMC ’03. ACM Press, 2003, p. 51. [Online]. Available: http://dx.doi.org/10.1145/948205.948214

    work page arXiv 2003

Show all 47 references
  1. [9]

    Traffic classi- fication through simple statistical fingerprinting,

    M. Crotti, M. Dusi, F. Gringoli, and L. Salgarelli, “Traffic classi- fication through simple statistical fingerprinting,”ACM SIGCOMM Computer Communication Review, vol. 37, no. 1, pp. 5–16, 2007

    2007

  2. [10]

    Deep learning and zero- day traffic classification: Lessons learned from a commercial-grade dataset,

    L. Yang, A. Finamore, F. Jun, and D. Rossi, “Deep learning and zero- day traffic classification: Lessons learned from a commercial-grade dataset,”IEEE Transactions on Network and Service Management, vol. 18, no. 4, p. 4103–4118, Dec. 2021. [Online]. Available: http://dx.doi.or...

    2021

  3. [11]

    Automatic mobile application traffic identification by convolutional neural networks,

    Z. Chen, B. Yu, Y . Zhang, J. Zhang, and J. Xu, “Automatic mobile application traffic identification by convolutional neural networks,” in 2016 IEEE Trustcom/BigDataSE/ISPA. IEEE, 2016, pp. 301–307

    2016

  4. [12]

    End-to-end en- crypted traffic classification with one-dimensional convolution neural networks,

    W. Wang, M. Zhu, J. Wang, X. Zeng, and Z. Yang, “End-to-end en- crypted traffic classification with one-dimensional convolution neural networks,” in2017 IEEE international conference on intelligence and security informatics (ISI). IEEE, 2017, pp. 43–48

    2017

  5. [13]

    Data augmentation for traffic classification,

    C. Wang, A. Finamore, P. Michiardi, M. Gallo, and D. Rossi, “Data augmentation for traffic classification,” inInternational Conference on Passive and Active Network Measurement. Springer, 2024, pp. 159–186

    2024

  6. [14]

    A critical study of few-shot learning for encrypted traffic classification,

    E. Akbari, S. A. Tahmid, N. Malekghaini, M. A. Salahuddin, N. Li- mam, R. Boutaba, B. Mathieu, S. Moteau, and S. Tuffin, “A critical study of few-shot learning for encrypted traffic classification,” in2023 19th International Conference on Network and Service Management (CNSM)....

    2023

  7. [15]

    Data drift in dl: Lessons learned from encrypted traffic classification,

    N. Malekghaini, E. Akbari, M. A. Salahuddin, N. Limam, R. Boutaba, B. Mathieu, S. Moteau, and S. Tuffin, “Data drift in dl: Lessons learned from encrypted traffic classification,” in2022 IFIP Network- ing Conference (IFIP Networking). IEEE, 2022, pp. 1–9

    2022

  8. [16]

    Characterization of Encrypted and VPN Traffic using Time-related Features:,

    G. Draper-Gil, A. H. Lashkari, M. S. I. Mamun, and A. A. Ghorbani, “Characterization of Encrypted and VPN Traffic using Time-related Features:,” inProceedings of the 2nd International Conference on Information Systems Security and Privacy, Rome, Italy, 2016, pp. 407–414

    2016

  9. [17]

    UNSW-NB15: A comprehensive data set for network intrusion detection systems,

    N. Moustafa and J. Slay, “UNSW-NB15: A comprehensive data set for network intrusion detection systems,” inProc. Military Commu- nications and Information Systems Conference (MilCIS), Canberra, Australia, 2015, pp. 1–6

    2015

  10. [18]

    Toward generat- ing a new intrusion detection dataset and intrusion traffic characteri- zation,

    I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generat- ing a new intrusion detection dataset and intrusion traffic characteri- zation,” inProc. 4th International Conference on Information Systems Security and Privacy (ICISSP). SciTePress, 2018, pp. 108–116

    2018

  11. [19]

    Errors in the cicids2017 dataset and the significant differences in detection performances it makes,

    M. Lanvin, P.-F. Gimenez, Y . Han, F. Majorczyk, L. M´e, and ´E. Totel, “Errors in the cicids2017 dataset and the significant differences in detection performances it makes,” inInternational Conference on Risks and Security of Internet and Systems. Springer, 2022, pp. 18–33

    2022

  12. [20]

    Distiller: En- crypted traffic classification via multimodal multitask deep learning,

    G. Aceto, D. Ciuonzo, A. Montieri, and A. Pescap ´e, “Distiller: En- crypted traffic classification via multimodal multitask deep learning,” Journal of Network and Computer Applications, vol. 183, p. 102985, 2021

    2021

  13. [21]

    A comprehensive survey for iot security datasets taxonomy, classification and machine learning mechanisms,

    C. Alex, G. Creado, W. Almobaideen, O. A. Alghanam, and M. Saadeh, “A comprehensive survey for iot security datasets taxonomy, classification and machine learning mechanisms,” Computers & Security, vol. 132, p. 103283, Sep. 2023. [Online]. Available: http://dx.doi.org/10.1016/...

    2023

  14. [22]

    Network intrusion datasets: A survey, limitations, and recommendations,

    P. Goldschmidt and D. Chud ´a, “Network intrusion datasets: A survey, limitations, and recommendations,”Computers & Security, p. 104510, 2025

    2025

  15. [23]

    Fine-grained TLS services classification with reject option,

    J. Luxemburk and T. ˇCejka, “Fine-grained TLS services classification with reject option,”Computer Networks, vol. 220, p. 109467, Jan

  16. [24]

    CESNET-QUIC22: A large one-month QUIC network traffic dataset from backbone lines,

    J. Luxemburk, K. Hynek, T. ˇCejka, A. Luka ˇcoviˇc, and P. ˇSiˇska, “CESNET-QUIC22: A large one-month QUIC network traffic dataset from backbone lines,”Data in Brief, vol. 46, p. 108888, Feb. 2023. [Online]. Available: https://doi.org/10.1016/j.dib.2023.108888

    2023

  17. [25]

    MIRAGE: Mobile-app traffic capture and ground-truth creation,

    G. Aceto, D. Ciuonzo, A. Montieri, V . Persico, and A. Pescap ´e, “MIRAGE: Mobile-app traffic capture and ground-truth creation,” in 2019 4th International Conference on Computing, Communications and Security (ICCCS), 2019, pp. 1–8

    2019

  18. [26]

    Contextual counters and multimodal deep learning for activity-level traffic classification of mobile communication apps dur- ing COVID-19 pandemic,

    I. Guarino, G. Aceto, D. Ciuonzo, A. Montieri, V . Persico, and A. Pescap `e, “Contextual counters and multimodal deep learning for activity-level traffic classification of mobile communication apps dur- ing COVID-19 pandemic,”Computer Networks, vol. 219, p. 109452, 2022

    2022

  19. [27]

    UTMobileNetTraf- fic2021: A labeled public network traffic dataset,

    Y . Heng, V . Chandrasekhar, and J. G. Andrews, “UTMobileNetTraf- fic2021: A labeled public network traffic dataset,”IEEE Networking Letters, vol. 3, no. 3, pp. 156–160, 2021

    2021

  20. [28]

    How to achieve high classification accuracy with just a few labels: A semi-supervised approach using sampled packets,

    S. Rezaei and X. Liu, “How to achieve high classification accuracy with just a few labels: A semi-supervised approach using sampled packets,” 2020

    2020

  21. [29]

    App- classnet: A commercial-grade dataset for application identification re- search,

    C. Wang, A. Finamore, L. Yang, K. Fauvel, and D. Rossi, “App- classnet: A commercial-grade dataset for application identification re- search,”ACM SIGCOMM Computer Communication Review, vol. 52, no. 3, pp. 19–27, Jul 2022

    2022

  22. [30]

    Edge-IIoTset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning,

    M. A. Ferrag, O. Friha, D. Hamouda, L. Maglaras, and H. Janicke, “Edge-IIoTset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning,” IEEE Access, vol. 10, pp. 40 281–40 306, 2022

    2022

  23. [31]

    Detection of doh tunnels using time-series classification of en- crypted traffic,

    M. MontazeriShatoori, L. Davidson, G. Kaur, and A. Habibi Lashkari, “Detection of doh tunnels using time-series classification of en- crypted traffic,” in5th Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech), Vancouver, Canada, Aug 2020, pp. 63–70

    2020

  24. [32]

    Optuna: A next-generation hyperparameter optimization framework,

    T. Akiba, S. Sano, T. Yanase, T. Ohta, and M. Koyama, “Optuna: A next-generation hyperparameter optimization framework,” in Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, ser. KDD ’19. New York, NY , USA: Association for Compu...

    2019

  25. [33]

    Improving performance, reliability, and feasibility in multimodal multitask traffic classification with xai,

    A. Nascita, A. Montieri, G. Aceto, D. Ciuonzo, V . Persico, and A. Pescap ´e, “Improving performance, reliability, and feasibility in multimodal multitask traffic classification with xai,”IEEE Transac- tions on Network and Service Management, vol. 20, no. 2, pp. 1267– 1289, 2023

    2023

  26. [34]

    Billion-scale similarity search with GPUs,

    J. Johnson, M. Douze, and H. J ´egou, “Billion-scale similarity search with GPUs,”IEEE Transactions on Big Data, vol. 7, no. 3, pp. 535– 547, 2019

    2019

  27. [35]

    Encrypted traffic classifica- tion: the QUIC case,

    J. Luxemburk, K. Hynek, and T. ˇCejka, “Encrypted traffic classifica- tion: the QUIC case,” in2023 7th Network Traffic Measurement and Analysis Conference (TMA), 2023, pp. 1–10

    2023

  28. [36]

    A lightweight, efficient and explainable-by-design convolutional neural network for internet traffic classification,

    K. Fauvel, F. Chen, and D. Rossi, “A lightweight, efficient and explainable-by-design convolutional neural network for internet traffic classification,” ser. KDD ’23. New York, NY , USA: Association for Computing Machinery, 2023, p. 4013–4023

    2023

  29. [37]

    Replication: Contrastive learning and data augmentation in traffic classification using a FlowPic input representation,

    A. Finamore, C. Wang, J. Krolikowski, J. M. Navarro, F. Chen, and D. Rossi, “Replication: Contrastive learning and data augmentation in traffic classification using a FlowPic input representation,” ser. IMC ’23. New York, NY , USA: Association for Computing Machinery, 2023, p. 36–51

    2023

  30. [38]

    Network traffic classification based on single flow time series analysis,

    J. Koumar, K. Hynek, and T. ˇCejka, “Network traffic classification based on single flow time series analysis,” in2023 19th International Conference on Network and Service Management (CNSM). IEEE, 2023, pp. 1–7

    2023

  31. [39]

    Nettisa: Extended ip flow with time-series features for universal bandwidth- constrained high-speed network traffic classification,

    J. Koumar, K. Hynek, J. Pe ˇsek, and T. ˇCejka, “Nettisa: Extended ip flow with time-series features for universal bandwidth- constrained high-speed network traffic classification,”Computer Networks, vol. 240, p. 110147, 2024. [Online]. Available: https: //www.sciencedirect.co...

    2024

  32. [40]

    Identifying malicious dns tunnel tools from doh traffic using hierar- chical machine learning classification,

    R. Mitsuhashi, A. Satoh, Y . Jin, K. Iida, T. Shinagawa, and Y . Takai, “Identifying malicious dns tunnel tools from doh traffic using hierar- chical machine learning classification,” inInformation Security: 24th International Conference, ISC 2021, Virtual Event, November 10–1...

    2021

  33. [41]

    Rosetta: Enabling robust tls encrypted traffic classification in diverse network environments with tcp-aware traffic augmentation,

    R. Xie, Y . Wang, J. Cao, E. Dong, M. Xu, K. Sun, Q. Li, L. Shen, and M. Zhang, “Rosetta: Enabling robust tls encrypted traffic classification in diverse network environments with tcp-aware traffic augmentation,” inProceedings of the ACM Turing Award Celebration Conference - C...

    2023

  34. [42]

    Establishing data provenance for responsible artificial intelligence systems,

    K. Werder, B. Ramesh, and R. Zhang, “Establishing data provenance for responsible artificial intelligence systems,”ACM Transactions on Management Information Systems (TMIS), vol. 13, no. 2, pp. 1–23, 2022

    2022

  35. [43]

    Dns over https detection using standard flow telemetry,

    K. Jerabek, K. Hynek, O. Rysavy, and I. Burgetova, “Dns over https detection using standard flow telemetry,”IEEE Access, vol. 11, pp. 50 000–50 012, 2023

    2023

  36. [44]

    Comparative analysis of dns over https detectors,

    K. Jerabek, K. Hynek, and O. Rysavy, “Comparative analysis of dns over https detectors,”Computer Networks, vol. 247, p. 110452, 2024

    2024

  37. [45]

    Cesnet-timeseries24: Time series dataset for network traffic anomaly detection and fore- casting,

    J. Koumar, K. Hynek, T. ˇCejka, and P. ˇSiˇska, “Cesnet-timeseries24: Time series dataset for network traffic anomaly detection and fore- casting,”Scientific Data, vol. 12, no. 1, p. 338, 2025

    2025

  38. [46]

    Decrypto: Finding cryptocurrency miners on isp networks,

    R. Pln ´y, K. Hynek, and T. ˇCejka, “Decrypto: Finding cryptocurrency miners on isp networks,” inNordic Conference on Secure IT Systems. Springer, 2022, pp. 139–158. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 Packet number CESNET-TLS22 CES...

    2022

  39. [2023]

    Available: https://doi.org/10.1016/j.comnet.2022

    [Online]. Available: https://doi.org/10.1016/j.comnet.2022. 109467

    2022 doi

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.