Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

Multi-view Correlation-aware Network Traffic Detection on Flow Hypergraph

T0 review · 5 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read FlowID, a hypergraph-based traffic detector, reports the best average score on every macro metric across five datasets.

desk verdict FlowID is a plausible new combination of known components, but the impossible numbers in Table III and Table I mean the SOTA claim is not currently supported. read the letter →

arxiv 2501.08610 v2 pith:6IJQJPKI submitted 2025-01-15 cs.CR

Jiajun Zhou , Wentao Fu , Hao Song , Shanqing Yu , Qi Xuan , Xiaoniu Yang This is my paper · ORCID
classification cs.CR
keywords NetworkTrafficDetectionCybersecurityHypergraphDataAugmentationContrastiveLearningFlowMulti-viewFeatureMalicious
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes FlowID, a network traffic detection framework built on a flow hypergraph. It aims to show that combining multi-view flow features with higher-order flow-group structure and dual-contrastive self-supervision gives better traffic classification than existing sequence-based and graph-based methods, especially for malicious and minority traffic. Across five public datasets, FlowID reports the best average rank on accuracy, macro precision, macro recall, and macro F1, with gains concentrated on encrypted and heavily imbalanced traffic. If the comparison is fair and leakage-free, the framework is a genuine step beyond single-view traffic classifiers.

What carries the argument

The load-bearing machinery is the flow hypergraph: every flow is a node, and for each flow a hyperedge connects it to its K nearest neighbours in Euclidean feature space. Features come from a multi-view extractor, with LSTM over directed packet-length sequences, CNN over payload byte sequences, and GCN over per-flow traffic interaction graphs, fused by concatenation and adaptive interpolation. A two-layer HyperGCN propagates information from nodes to hyperedges and back, and three random augmentations (node-feature masking, hyperedge-weight perturbation, and membership masking) generate two views for a dual contrastive loss, pulling same-flow pairs together while pushing other flows and groups apart. The contrastive losses act as regularizers on the supervised classification objective.

What would settle it

Run the comparison again with every baseline fed FlowID's exact multi-view feature inputs, and audit the hypergraph construction to confirm no test flow appears among the K nearest neighbours of a training flow; if a baseline then matches FlowID's macro-F1, or if the train/test split is found to share flows, the state-of-the-art claim fails.

Watch

Extended reading notes

Core claim

The central claim is that treating each network flow as a node in a KNN-built flow hypergraph, and learning with a HyperGCN encoder regularized by flow-to-flow and group-to-group contrastive losses, yields a traffic detector that generalizes across IoMT, VPN, darknet, malware, and intrusion scenarios. The paper reports top results on all five datasets: FlowID has the best average rank on every macro metric, with macro-F1 improvements of roughly 1.2 to 2.0 points over the strongest baselines on Darknet2020 and ISCX-VPN2016 and smaller gains elsewhere. The authors attribute the gains to three design choices: multi-view feature fusion, hypergraph message passing among similar flows, and contrastive self-supervision that copes with label scarcity and class imbalance.

Load-bearing premise

The strongest result assumes the experimental comparison is fair: test flows never leak into the training hypergraph, and every baseline receives the same multi-view features and preprocessing.

Editorial extensions

If this is right

  • If the reported results hold, a deployed detector could use hypergraph snapshots over fixed time windows to classify flows online without retraining on the whole stream.
  • The ablations indicate that every view in the extractor contributes; removing the GNN, CNN, or LSTM branch degrades macro-F1, so a single-feature model is weaker than the fusion.
  • The dual-contrastive constraints add regularization: dropping either contrastive loss lowers performance on most datasets, and using both gives the best results.
  • Structural perturbation of hyperedges gives more stable gains than node-feature masking, pointing to topology-aware augmentation as the effective self-supervision signal for traffic hypergraphs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural test the paper leaves implicit is evaluating FlowID on modern encrypted protocols such as QUIC and TLS 1.3, where payload bytes are scarce and the CNN payload branch may become less informative.
  • Because KNN hyperedge construction requires pairwise distances between all flows, scaling the method to backbone-scale traffic would likely need approximate nearest-neighbour or clustering-based hyperedge formation, which the paper does not address.
  • Since the nine baselines are not documented as receiving identical multi-view inputs, a matched-input re-run is the cleanest way to isolate whether the improvement comes from the hypergraph and contrastive module or from the richer features alone.
  • A low-label experiment measuring only rare-class recall could determine whether the group-to-group contrast, rather than the flow-to-flow contrast, is responsible for the robustness gains under class imbalance.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The manuscript proposes FlowID, a network traffic detection framework that combines multi-view feature extraction (LSTM on packet-length sequences, CNN on payload bytes, GCN on traffic interaction graphs), KNN-based flow hypergraph construction, a HyperGCN encoder, and dual flow-to-flow / group-to-group contrastive losses. The method is evaluated on five public datasets (CIC-IOMT2024, UNSW-NB15, Darknet2020, ISCX-VPN2016, USTC-TFC2016) against nine baselines. The paper claims state-of-the-art accuracy, robustness, and generalization, with the headline evidence being the average-rank results in Table II and the per-class results in Table III. The central methodological idea is coherent and the ablation structure is reasonable, but the reported numerical evidence contains internal inconsistencies and the evaluation protocol leaves load-bearing details underspecified.

Significance. If the reported results are correct, FlowID would be a meaningful empirical contribution: it combines multi-view traffic features with higher-order hypergraph structure and contrastive self-supervision, and it is evaluated across diverse traffic datasets with ablations for each component (Tables IV-VII). The paper also introduces hypergraph-specific augmentation strategies (node feature masking, hyperedge weight perturbation, membership masking) that are of independent interest. However, the quantitative foundation of the SOTA claim is currently unreliable: Table III contains per-class F1 values that are arithmetically impossible given the reported precision and recall, and these values feed directly into the macro-F1 averages of Table II. In addition, the hyperparameters n, m, and K are selected using the test datasets themselves, and the claimed robustness and label-scarcity advantages are not tested. The contribution is potentially salvageable, but the evidence as presented does not support the advertised conclusions.

major comments (5)
  1. [Table III and Eq. (13)] The per-class F1 values in Table III are not mathematically consistent with the reported precision and recall under the definition in Eq. (13). For Darknet2020 Email, P=42.02% and R=93.75% imply a maximum possible F1 of 2PR/(P+R)=58.03%, yet Table III reports 89.36%. For CIC-IOMT2024 ARP, P=98.75% and R=94.13% imply F1 must be at least min(P,R)=94.13%, yet the table reports 87.53%. For UNSW-NB15 DoS, the reported P=60.87% and R=58.42% give F1=59.62%, not 66.25%. For ISCX-VPN2016 Chat, P=87.48% and R=99.11% give F1=92.95%, not 79.26%. Since Table II's macro-F1 is the average of these per-class values, the headline comparison is built on numbers that cannot all be correct. The authors must recompute all per-class and macro metrics or clearly state a different definition of F1 if one was used.
  2. [Section IV-D, Fig. 3, Fig. 4] The hyperparameters n (number of packets), m (payload bytes), and K (number of nearest neighbors) are tuned by observing performance on the same five datasets that are later used for the final comparison in Table II. Section IV-D states the chosen values (n=40, m=16, K=3) after Fig. 3 and Fig. 4 show performance over the parameter grids on those datasets. Without a separately held-out validation set or a nested validation protocol, the reported test results are post-hoc selections and the claim that FlowID 'significantly outperforms' baselines is not supported. Please specify the split procedure explicitly and either report results for all hyperparameter settings or select hyperparameters on disjoint validation data.
  3. [Section III-E and Section IV-B] The evaluation protocol is underspecified in a way that makes the comparison hard to interpret. Section III-E states that training, validation, and testing sets are 'three independent, uncorrelated hypergraphs', but the exact splitting procedure and the hypergraph construction for each split are not described. If the KNN hypergraph construction is performed on the combined data before splitting, or if test flows participate in training hyperedges, the results would be leakage-inflated. Similarly, Section IV-B lists nine baselines but does not document which input features each baseline received, how hypergraph baselines (HGNN, HGNN+) were given multi-view features, or whether all methods used the same preprocessing. This omission matters because the paper claims hypergraph baselines 'also accept multi-view features as input'. Please provide the full data-splitting and hypergraph-building protocol and the exact feature inputs used for each baseline.
  4. [Table I and Section III-B] Table I reports 'Membership' as exactly 3.0 for all five datasets, with the total membership count equal to 3 times the number of flows (e.g., 32,502 flows and 97,506 memberships for CIC-IOMT2024). However, Section III-B states that each hyperedge is formed by 'the K most similar flows and itself' with K=3, yielding hyperedges of size 4. The reported incidence statistics and the stated construction rule cannot both be correct. Please clarify the definition of 'Membership' and recompute the hypergraph statistics, or correct the construction description.
  5. [Abstract, Section III-C, Section V] The abstract and conclusion claim improvements in 'robustness' and 'generalization', and Section III-C motivates the dual-contrastive loss by data imbalance and label scarcity. However, no experiment varies the amount of labeled data, introduces synthetic noise or interference, or manipulates class imbalance. The ablation tables (Tables VI and VII) show small gains from the contrastive losses in most settings, but they do not test the label-scarcity or robustness scenarios that are used as motivation. Either add experiments that directly test these claims (e.g., training with 1%, 10%, 50% of labels, or adding noise to flow features) or temper the claims to what is actually demonstrated.
minor comments (5)
  1. [Eq. (2)] Equation (2) has an extra closing parenthesis: 'ZCNN = Attention(CNN(Xbyte)))' should read 'ZCNN = Attention(CNN(Xbyte))'.
  2. [Tables IV-VII] Several table headers contain typos: 'Abaltion' should be 'Ablation', 'Precison' should be 'Precision', and 'Accuracy' appears in the contrastive ablation tables where the table actually shows 'Precision' in some columns.
  3. [Section IV-D] In the experimental setting paragraph, the text says 'the number of intercepted packets m to 40, and the number of payload bytes to 16'; the variables are reversed relative to the earlier notation where n is the packet count and m is the byte count.
  4. [Abstract and Section III-C] The abstract refers to 'traffic-to-traffic and group-to-group contrast', while the body consistently uses 'flow-to-flow' and 'hyperedge-hyperedge' terminology; please align the terminology throughout.
  5. [Fig. 3] Figure 3 is difficult to read: the color mapping and axis labels do not clearly indicate which metric is being plotted for each value of n and m, and the reported numerical range appears to show only recall-like values. Please redraw with explicit legend and metric labels.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: FlowID's contributions are proposed mechanisms benchmarked on external datasets; self-citations appear only as background and are not load-bearing.

full rationale

FlowID's derivation chain is a proposed architecture rather than a mathematical reduction. The multi-view features (Eqs. 1-5), KNN hypergraph construction (Section III-B), HyperGCN encoding (Eq. 6), and dual-contrastive losses (Eqs. 7-10) are defined independently of the labels they predict; the final loss (Eq. 12) simply adds the supervised cross-entropy to the contrastive terms. No equation defines a target quantity in terms of the predicted output, and no fitted parameter is renamed as a prediction. Self-citations [16], [22], [24]-[26], [37]-[39] appear for background on GNNs, community detection, fraud detection, and graph augmentation, but the paper's central hypergraph learning and augmentation designs are specified in-place and do not rest on those citations as evidence. The headline SOTA claim is tested against five external datasets and nine external baselines, so it is not forced by construction. The manuscript does contain serious internal inconsistencies -- e.g., Table III reports per-class F1 values inconsistent with its own P/R under Eq. 13 (Darknet2020 Email P=42.02/R=93.75 cannot have F1=89.36), and Table I reports average membership 3.0 while Section III-B with K=3 implies hyperedge size 4 -- but those are arithmetic/reproducibility defects that undermine the empirical evidence, not circularity in the derivation.

Assumptions & free parameters 6 free parameters · 6 assumptions · 0 invented entities

No new physical or conceptual entities are invented. FlowID introduces a flow hypergraph representation, but that is a data structure built from input features rather than an independent postulated entity. All free parameters are hand-chosen or tuned on the evaluation datasets, which the paper reports.

free parameters (6)
  • K (number of nearest neighbors per hyperedge) = 3 (selected via Fig. 4 sweep over {2,3,5,10,50,100,200})
    Central hypergraph construction parameter; performance declines for large K; chosen on the same datasets used for final results.
  • n (number of packets per flow) = 40 (selected via Fig. 3 sweep over {10,...,100})
    Sequence truncation for LSTM, CNN, and Traffic Interaction Graph; tuned on the same datasets.
  • m (payload bytes per packet) = 16 (selected via Fig. 3 sweep over {16,...,32})
    Payload truncation for CNN; tuned on the same datasets.
  • omega_n and omega_g (contrastive loss weights in Eq. 12) = not reported
    Weights balancing classification and dual-contrastive losses; values are absent from the paper.
  • tau_n and tau_g (contrastive temperatures in Eq. 7 and Eq. 9) = not reported
    Temperature parameters control contrastive hardness; values are not stated.
  • Augmentation masking rates pn, pw, pm = 0.4 stated for augmentation ablations in Section IV-I
    Masking probabilities for node feature masking, hyperedge weight perturbation, and membership masking; used in main experiments.
assumptions (6)
  • domain assumption The first n packets and first m payload bytes per packet suffice to represent a flow for detection.
    Invoked in Section III-A and tuned in Section IV-F; zero-padding assumes missing packets carry no discriminative signal.
  • domain assumption Euclidean KNN in multi-view feature space groups flows into label-relevant hyperedges.
    Section III-B constructs hyperedges from feature similarity; if similar flows do not share behavioral class, hypergraph propagation and group contrast can inject noise.
  • domain assumption Contrastive self-supervision improves classification under label scarcity and class imbalance.
    Core motivation in Section III-C, but no experiment with reduced labels or controlled imbalance ratios is reported.
  • domain assumption Train, validation, and test hypergraphs are independent and uncorrelated.
    Section III-E asserts this; the exact split and hypergraph construction procedure are not detailed.
  • domain assumption Baselines were given equivalent input features and preprocessing.
    Section IV-B describes baselines but not the feature preprocessing applied to each; the SOTA claim assumes fair comparison.
  • standard math Hypergraph convolution in Eq. 6 and HyperGCN message passing are valid standard operations.
    Borrowed from Yadati et al. [28]; not re-derived in this paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Multi-view Correlation-aware Network Traffic Detection on Flow Hypergraph." pith.science (2026). https://pith.science/paper/6IJQJPKI

@misc{pith2026250108610,
  author       = {Pith},
  title        = {Pith review of: Multi-view Correlation-aware Network Traffic Detection on Flow Hypergraph},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6IJQJPKI}},
  note         = {Machine review of arXiv:2501.08610}
}
read the original abstract

As the Internet rapidly expands, the increasing complexity and diversity of network activities pose significant challenges to effective network governance and security regulation. Network traffic, which serves as a crucial data carrier of network activities, has become indispensable in this process. Network traffic detection aims to monitor, analyze, and evaluate the data flows transmitted across the network to ensure network security and optimize performance. However, existing network traffic detection methods generally suffer from several limitations: 1) a narrow focus on characterizing traffic features from a single perspective; 2) insufficient exploration of discriminative features for different traffic; 3) poor generalization to different traffic scenarios. To address these issues, we propose a multi-view correlation-aware framework named FlowID for network traffic detection. FlowID captures multi-view traffic features via temporal and interaction awareness, while a hypergraph encoder further explores higher-order relationships between flows. To overcome the challenges of data imbalance and label scarcity, we design a dual-contrastive proxy task, enhancing the framework's ability to differentiate between various traffic flows through flow-to-flow and group-to-group contrast. Extensive experiments on five real-world datasets demonstrate that FlowID significantly outperforms existing methods in accuracy, robustness, and generalization across diverse network scenarios, particularly in detecting malicious traffic.

Figures

Figures reproduced from arXiv: 2501.08610 by the authors.

Figure 1
Figure 1. The architecture of FlowID: 1) Multi-view traffic feature extraction via temporal feature awareness and interaction feature awareness; 2) Traffic hypergraph construction to capture higher-order flow relationships; 3) Traffic hypergraph learning using hypergraph convolution and double contrastive learning. associated with data volume. RHCRN [32] employs routing hypergraph convolutional recursive networks to treat rou… view at source ↗
Figure 2
Figure 2. An example of traffic sequence and graph construction [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The impact of the number of packets (n) and the number of payload bytes (m) used in the multi-view feature extraction process on the framework’s performance. 58.42%, respectively, with the F1-score of 66.25%, suggesting that further model optimization is needed to improve detection accuracy. Additionally, in the Email traffic of the Darknet2020 dataset, despite relatively high recall of 93.75%, the precision is low … view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: The impact of the K-value setting during flow hypergraph construction on the framework’s performance. [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Traffic Classifier gain (%) when contrasting different [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. On the Feasibility of Inter-Flow Service Degradation Detection

    cs.NI 2025-09 conditional novelty 6.0 of 10

    Concurrent visible flows contain early signals about degradation in hardware-offloaded invisible flows, but standard ML models ignore these signals when features are simply concatenated.

Reference graph

Works this paper leans on

53 extracted references · 38 canonical work pages · cited by 1 Pith paper

  1. [1]

    A synthetic traffic model for half-life,

    T. Lang, G. Armitage, P. Branch, and H.-Y . Choo, “A synthetic traffic model for half-life,” in Australian Telecommunications Networks & Applications Conference, vol. 2003, 2003

    work page 2003

  2. [2]

    Empirically derived analytic models of wide-area tcp connections,

    V . Paxson, “Empirically derived analytic models of wide-area tcp connections,” IEEE/ACM transactions on Networking , vol. 2, no. 4, pp. 316–336, 1994

    work page 1994

  3. [3]

    Robust network traffic classification,

    J. Zhang, X. Chen, Y . Xiang, W. Zhou, and J. Wu, “Robust network traffic classification,” IEEE/ACM transactions on networking , vol. 23, no. 4, pp. 1257–1270, 2014

    work page 2014

  4. [4]

    A survey of techniques for internet traffic classification using machine learning,

    T. T. Nguyen and G. Armitage, “A survey of techniques for internet traffic classification using machine learning,” IEEE communications surveys & tutorials , vol. 10, no. 4, pp. 56–76, 2008

    work page 2008

  5. [5]

    Classification of attacks using support vector machine (svm) on kddcup’99 ids database,

    M. V . Kotpalliwar and R. Wajgi, “Classification of attacks using support vector machine (svm) on kddcup’99 ids database,” in 2015 Fifth International Conference on Communication Systems and Network Technologies. IEEE, 2015, pp. 987–990

    work page 2015

  6. [6]

    Ddos detection and anal- ysis in sdn-based environment using support vector machine classifier,

    R. Kokila, S. T. Selvi, and K. Govindarajan, “Ddos detection and anal- ysis in sdn-based environment using support vector machine classifier,” in 2014 sixth international conference on advanced computing (ICoAC) . IEEE, 2014, pp. 205–210

    work page 2014

  7. [7]

    A survey of deep learning-based network anomaly detection,

    D. Kwon, H. Kim, J. Kim, S. C. Suh, I. Kim, and K. J. Kim, “A survey of deep learning-based network anomaly detection,” Cluster Computing, vol. 22, pp. 949–961, 2019

    work page 2019

  8. [8]

    Machine learning and deep learning methods for intrusion detection systems: A survey,

    H. Liu and B. Lang, “Machine learning and deep learning methods for intrusion detection systems: A survey,” applied sciences, vol. 9, no. 20, p. 4396, 2019

    work page 2019

Show all 53 references
  1. [9]

    Toward the accurate identification of network applications,

    A. W. Moore and K. Papagiannaki, “Toward the accurate identification of network applications,” in International workshop on passive and active network measurement. Springer, 2005, pp. 41–54

    2005

  2. [10]

    Appscanner: Automatic fingerprinting of smartphone apps from encrypted network traffic,

    V . F. Taylor, R. Spolaor, M. Conti, and I. Martinovic, “Appscanner: Automatic fingerprinting of smartphone apps from encrypted network traffic,” in 2016 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2016, pp. 439–454

    2016

  3. [11]

    Flowprint: Semi-supervised mobile-app fingerprinting on encrypted network traf- fic,

    T. Van Ede, R. Bortolameotti, A. Continella, J. Ren, D. J. Dubois, M. Lindorfer, D. Choffnes, M. Van Steen, and A. Peter, “Flowprint: Semi-supervised mobile-app fingerprinting on encrypted network traf- fic,” in Network and distributed system security symposium (NDSS) , vol. 27, 2020

    2020

  4. [12]

    Encrypted traffic classification: Combining over-and under-sampling through a pca-svm,

    A. Saber, B. Fergani, and M. Abbas, “Encrypted traffic classification: Combining over-and under-sampling through a pca-svm,” in 2018 3rd International Conference on Pattern Analysis and Intelligent Systems (PAIS). IEEE, 2018, pp. 1–5

    2018

  5. [13]

    Fs-net: A flow sequence network for encrypted traffic classification,

    C. Liu, L. He, G. Xiong, Z. Cao, and Z. Li, “Fs-net: A flow sequence network for encrypted traffic classification,” in IEEE INFOCOM 2019- IEEE Conference On Computer Communications . IEEE, 2019, pp. 1171–1179. 12

    2019

  6. [14]

    Mtt: an efficient model for encrypted network traffic classification using multi-task transformer,

    W. Zheng, J. Zhong, Q. Zhang, and G. Zhao, “Mtt: an efficient model for encrypted network traffic classification using multi-task transformer,” Applied Intelligence, vol. 52, no. 9, pp. 10 741–10 756, 2022

    2022

  7. [15]

    Netmamba: Efficient network traffic classification via pre-training unidirectional mamba,

    T. Wang, X. Xie, W. Wang, C. Wang, Y . Zhao, and Y . Cui, “Netmamba: Efficient network traffic classification via pre-training unidirectional mamba,” arXiv preprint arXiv:2405.11449 , 2024

    2024 arXiv

  8. [16]

    Clarify confused nodes via separated learning,

    J. Zhou, S. Gong, X. Chen, C. Xie, S. Yu, Q. Xuan, and X. Yang, “Clarify confused nodes via separated learning,” IEEE Transactions on Pattern Analysis and Machine Intelligence , 2025

    2025

  9. [17]

    Flow-based encrypted network traffic classification with graph neural networks,

    T.-L. Huoh, Y . Luo, P. Li, and T. Zhang, “Flow-based encrypted network traffic classification with graph neural networks,” IEEE Transactions on Network and Service Management, vol. 20, no. 2, pp. 1224–1237, 2022

    2022

  10. [18]

    Ftg-net: Hierarchical flow-to-traffic graph neural network for ddos attack detec- tion,

    L. Barsellotti, L. De Marinis, F. Cugini, and F. Paolucci, “Ftg-net: Hierarchical flow-to-traffic graph neural network for ddos attack detec- tion,” in 2023 IEEE 24th International Conference on High Performance Switching and Routing (HPSR) . IEEE, 2023, pp. 173–178

    2023

  11. [19]

    Intrusion detection for encrypted flows using single feature based on graph integration theory,

    Y . Han, X. Wang, M. He, X. Wang, and S. Guo, “Intrusion detection for encrypted flows using single feature based on graph integration theory,” IEEE Internet of Things Journal , 2024

    2024

  12. [20]

    De- gnn: Dual embedding with graph neural network for fine-grained en- crypted traffic classification,

    X. Han, G. Xu, M. Zhang, Z. Yang, Z. Yu, W. Huang, and C. Meng, “De- gnn: Dual embedding with graph neural network for fine-grained en- crypted traffic classification,” Computer Networks, vol. 245, p. 110372, 2024

    2024

  13. [21]

    Graph convolutional neural networks for web-scale rec- ommender systems,

    R. Ying, R. He, K. Chen, P. Eksombatchai, W. L. Hamilton, and J. Leskovec, “Graph convolutional neural networks for web-scale rec- ommender systems,” in Proceedings of the 24th ACM SIGKDD inter- national conference on knowledge discovery & data mining , 2018, pp. 974–983

    2018

  14. [22]

    Robustecd: Enhancement of network structure for robust community detection,

    J. Zhou, Z. Chen, M. Du, L. Chen, S. Yu, G. Chen, and Q. Xuan, “Robustecd: Enhancement of network structure for robust community detection,” IEEE Transactions on Knowledge and Data Engineering , vol. 35, no. 1, pp. 842–856, 2021

    2021

  15. [23]

    Supervised community detection with line graph neural networks,

    Z. Chen, L. Li, and J. Bruna, “Supervised community detection with line graph neural networks,” in International conference on learning representations, 2020, pp. 1–23

    2020

  16. [24]

    Heterogeneous feature augmentation for ponzi detection in ethereum,

    C. Jin, J. Jin, J. Zhou, J. Wu, and Q. Xuan, “Heterogeneous feature augmentation for ponzi detection in ethereum,” IEEE Transactions on Circuits and Systems II: Express Briefs , vol. 69, no. 9, pp. 3919–3923, 2022

    2022

  17. [25]

    Time-aware metapath feature augmentation for ponzi detection in ethereum,

    C. Jin, J. Zhou, J. Jin, J. Wu, and Q. Xuan, “Time-aware metapath feature augmentation for ponzi detection in ethereum,” IEEE Transactions on Network Science and Engineering , vol. 11, no. 4, pp. 3747–3758, 2024

    2024

  18. [26]

    Behavior- aware account de-anonymization on ethereum interaction graph,

    J. Zhou, C. Hu, J. Chi, J. Wu, M. Shen, and Q. Xuan, “Behavior- aware account de-anonymization on ethereum interaction graph,” IEEE Transactions on Information Forensics and Security , vol. 17, pp. 3433– 3448, 2022

    2022

  19. [27]

    Hypergraph neural net- works,

    Y . Feng, H. You, Z. Zhang, R. Ji, and Y . Gao, “Hypergraph neural net- works,” in Proceedings of the AAAI conference on artificial intelligence , vol. 33, no. 01, 2019, pp. 3558–3565

    2019

  20. [28]

    Hypergcn: A new method for training graph convolutional networks on hypergraphs,

    N. Yadati, M. Nimishakavi, P. Yadav, V . Nitin, A. Louis, and P. Talukdar, “Hypergcn: A new method for training graph convolutional networks on hypergraphs,” Advances in neural information processing systems , vol. 32, 2019

    2019

  21. [29]

    Hypergraph attention net- works,

    C. Chen, Z. Cheng, Z. Li, and M. Wang, “Hypergraph attention net- works,” in 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) . IEEE, 2020, pp. 1560–1565

    2020

  22. [30]

    Next-item recommendation with sequential hypergraphs,

    J. Wang, K. Ding, L. Hong, H. Liu, and J. Caverlee, “Next-item recommendation with sequential hypergraphs,” in Proceedings of the 43rd international ACM SIGIR conference on research and development in information retrieval , 2020, pp. 1101–1110

    2020

  23. [31]

    Hypergraph clustering for better network traffic inspection,

    L. Pu and B. Faltings, “Hypergraph clustering for better network traffic inspection,” in The 3rd Workshop on Intelligent Security at IJCAI, 2011

    2011

  24. [32]

    Routing hypergraph con- volutional recurrent network for network traffic prediction,

    W. Yu, K. Ruan, H. Tang, and J. Huang, “Routing hypergraph con- volutional recurrent network for network traffic prediction,” Applied Intelligence, vol. 53, no. 12, pp. 16 126–16 137, 2023

    2023

  25. [33]

    Hrnn: Hypergraph recurrent neural network for network intrusion detection,

    Z. Yang, Z. Ma, W. Zhao, L. Li, and F. Gu, “Hrnn: Hypergraph recurrent neural network for network intrusion detection,” Journal of Grid Computing, vol. 22, no. 2, pp. 1–15, 2024

    2024

  26. [34]

    Long short-term memory,

    S. Hochreiter and J. Schmidhuber, “Long short-term memory,” Neural computation, vol. 9, no. 8, pp. 1735–1780, 1997

    1997

  27. [35]

    Accurate decentralized application identification via encrypted traffic analysis using graph neural networks,

    M. Shen, J. Zhang, L. Zhu, K. Xu, and X. Du, “Accurate decentralized application identification via encrypted traffic analysis using graph neural networks,” IEEE Transactions on Information Forensics and Security, vol. 16, pp. 2367–2380, 2021

    2021

  28. [36]

    Semi-supervised classification with graph convolutional networks,

    T. N. Kipf and M. Welling, “Semi-supervised classification with graph convolutional networks,” arXiv preprint arXiv:1609.02907 , 2016

    2016 arXiv

  29. [37]

    Data augmentation on graphs: a technical survey,

    J. Zhou, C. Xie, S. Gong, Z. Wen, X. Zhao, Q. Xuan, and X. Yang, “Data augmentation on graphs: a technical survey,” arXiv preprint arXiv:2212.09970, 2022

    2022 arXiv

  30. [38]

    M-evolve: structural- mapping-based data augmentation for graph classification,

    J. Zhou, J. Shen, S. Yu, G. Chen, and Q. Xuan, “M-evolve: structural- mapping-based data augmentation for graph classification,” IEEE Trans- actions on Network Science and Engineering, vol. 8, no. 1, pp. 190–200, 2020

    2020

  31. [39]

    Data augmentation for graph classifi- cation,

    J. Zhou, J. Shen, and Q. Xuan, “Data augmentation for graph classifi- cation,” in Proceedings of the 29th ACM International Conference on Information & Knowledge Management , 2020, pp. 2341–2344

    2020

  32. [40]

    Ciciomt2024: Attack vectors in healthcare devices-a multi-protocol dataset for assessing iomt device security,

    S. Dadkhah, E. Carlos Pinto Neto, R. Ferreira, R. Chukwuka Molokwu, S. Sadeghi, and A. Ghorbani, “Ciciomt2024: Attack vectors in healthcare devices-a multi-protocol dataset for assessing iomt device security,” Raphael and Chukwuka Molokwu, Reginald and Sadeghi, Somayeh and Gho...

    2024

  33. [41]

    Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set),

    N. Moustafa and J. Slay, “Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set),” in 2015 military communications and information systems conference (MilCIS). IEEE, 2015, pp. 1–6

    2015

  34. [42]

    Didarknet: A contemporary approach to detect and characterize the darknet traffic using deep image learning,

    A. Habibi Lashkari, G. Kaur, and A. Rahali, “Didarknet: A contemporary approach to detect and characterize the darknet traffic using deep image learning,” in Proceedings of the 2020 10th International Conference on Communication and Network Security , 2020, pp. 1–13

    2020

  35. [43]

    Characterization of encrypted and vpn traffic using time-related,

    G. Draper-Gil, A. H. Lashkari, M. S. I. Mamun, and A. A. Ghorbani, “Characterization of encrypted and vpn traffic using time-related,” in Proceedings of the 2nd international conference on information systems security and privacy (ICISSP) , 2016, pp. 407–414

    2016

  36. [44]

    Malware traffic classification using convolutional neural network for representation learning,

    W. Wang, M. Zhu, X. Zeng, X. Ye, and Y . Sheng, “Malware traffic classification using convolutional neural network for representation learning,” in 2017 International conference on information networking (ICOIN). IEEE, 2017, pp. 712–717

    2017

  37. [45]

    A framework for resource-aware online traffic classification using cnn,

    W. Zhang, J. Wang, S. Chen, H. Qi, and K. Li, “A framework for resource-aware online traffic classification using cnn,” in Proceedings of the 14th International Conference on Future Internet Technologies , 2019, pp. 1–6

    2019

  38. [46]

    An lstm- based deep learning approach for classifying malicious traffic at the packet level,

    R.-H. Hwang, M.-C. Peng, V .-L. Nguyen, and Y .-L. Chang, “An lstm- based deep learning approach for classifying malicious traffic at the packet level,” Applied Sciences, vol. 9, no. 16, p. 3414, 2019

    2019

  39. [47]

    App-net: A hybrid neural network for encrypted mobile traffic classification,

    X. Wang, S. Chen, and J. Su, “App-net: A hybrid neural network for encrypted mobile traffic classification,” in IEEE INFOCOM 2020- IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). IEEE, 2020, pp. 424–429

    2020

  40. [48]

    Tcgnn: Packet-grained network traffic classification via graph neural networks,

    G. Hu, X. Xiao, M. Shen, B. Zhang, X. Yan, and Y . Liu, “Tcgnn: Packet-grained network traffic classification via graph neural networks,” Engineering Applications of Artificial Intelligence , vol. 123, p. 106531, 2023

    2023

  41. [49]

    Hgnn+: General hypergraph neural networks,

    Y . Gao, Y . Feng, S. Ji, and R. Ji, “Hgnn+: General hypergraph neural networks,” IEEE Transactions on Pattern Analysis and Machine Intelli- gence, vol. 45, no. 3, pp. 3181–3199, 2022

    2022

  42. [50]

    Graphddos: Effective ddos attack detection using graph neural networks,

    Y . Li, R. Li, Z. Zhou, J. Guo, W. Yang, M. Du, and Q. Liu, “Graphddos: Effective ddos attack detection using graph neural networks,” in 2022 IEEE 25th International Conference on Computer Supported Coopera- tive Work in Design (CSCWD) . IEEE, 2022, pp. 1275–1280

    2022

  43. [51]

    Tfe-gnn: A temporal fusion encoder using graph neural networks for fine-grained encrypted traffic classification,

    H. Zhang, L. Yu, X. Xiao, Q. Li, F. Mercaldo, X. Luo, and Q. Liu, “Tfe-gnn: A temporal fusion encoder using graph neural networks for fine-grained encrypted traffic classification,” in Proceedings of the ACM Web Conference 2023, 2023, pp. 2066–2075

    2023

  44. [52]

    Multi-class network traffic genera- tors and classifiers based on neural networks,

    R. Bikmukhamedov and A. Nadeev, “Multi-class network traffic genera- tors and classifiers based on neural networks,” in2021 Systems of Signals Generating and Processing in the Field of on Board Communications . IEEE, 2021, pp. 1–7. 13 Jiajun Zhou received the Ph.D degree in co...

    2021

  45. [2017]

    From 2012 to 2014, he was a Post-Doctoral Fellow with the Department of Computer Science, University of California at Davis, CA, USA. He is a senior member of the IEEE and is currently a Professor with the Institute of Cyberspace Security, College of Information Engineering, Z...

    2012

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.