Pith. sign in

REVIEW 4 major objections 6 minor 48 references

Magnifier: Detecting Network Access via Lightweight Traffic-based Fingerprints

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Magnifier claims that the burst of domain names a mobile device contacts while joining a network is a stable, brand-specific fingerprint, so a gateway can passively detect the connection and identify the brand and model in real time…

desk verdict A solid empirical system paper with a testable central claim; the headline numbers need event-level analysis and threshold selection on held-out data before I'd trust them. read the letter →

arxiv 2412.13428 v1 pith:JTJM56GT submitted 2024-12-18 cs.NI cs.CR

Wenhao Li , Qiang Wang , Huaifeng Bao , Xiao-Yu Zhang , Lingyun Ying , Zhaoxuan Li This is my paper · ORCID
classification cs.NIcs.CR
keywords networkaccessdetectiontrafficfingerprintingdomainnameforestDNSburstanalysismobiledeviceidentificationpassivegatewaymonitoringencryptedclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a network's gateway can tell which mobile device has just joined the network by passively watching the burst of domain names the device contacts, with no monitoring software on the phone. To do this it proposes Magnifier, which builds a Domain Name Forest (dnForest) fingerprint for each device brand and model from the DNS, TLS, and HTTP domain names observed during the join. A two-stage distillation step down-weights common background domains and up-weights brand-specific ones, and a lightweight matcher scores an observed 15-second window against every fingerprint. Under the paper's evaluation on a 26-model, 7-brand dataset, the method detects initial access at 98.41% detection rate with 0.25% false alarm rate at brand level and 97.16% at model level, and stays near those figures for repetitive access despite local DNS caches. If the paper is right, network administrators get a low-cost, real-time way to catch unauthorized phones entering a network.

What carries the argument

The central object is the Domain Name Forest (dnForest): for each device class, a collection of Domain Name Trees (dnTrees), one per top-level domain, where each dnTree is a weighted directed acyclic graph whose nodes are domain names at successive levels (for example, apple.com, m.apple.com, store.m.apple.com) together with their observed counts. The load-bearing operation is two-stage distillation: first, each dnTree is weighted by the summed contribution of its decision paths, so structurally complex brand-specific trees dominate; second, a tree-based TF-IDF adjustment raises nodes that appear in few other classes' forests. Matching is then a lightweight sum over observed domains in a 15-second window, triggered by captured DNS traffic, with an optional collector that fills in all nodes of a well-covered dnTree when local DNS caching makes a repeated join burst partially invisible.

What would settle it

Take a current mainstream phone, disable or uninstall every vendor component (app store, weather, cloud sync), and watch its join burst: if no brand-distinctive set of domain names remains, no fingerprint can match it. A less destructive test is to train on NetCess2023 and then capture the same models after a major OS update and in a different country; if the domain bursts shift materially, the reported detection rates would fall.

Watch

Extended reading notes

Core claim

The central claim is that the act of joining a network is itself fingerprintable: every time a phone connects, its preinstalled brand components quietly contact servers tied to that vendor, and the resulting set of domain names, organized by shared top-level domains, is distinctive enough to identify the device. Magnifier encodes this as a dnForest for each device class, with each dnTree carrying (domain, count) nodes, and a two-stage distillation algorithm weights structurally complex brand-specific trees upward and common background trees downward. Classification is a simple additive score of how many observed domain nodes in the 15-second window match weighted fingerprint nodes, which keeps the detector fast enough for real-time use. The paper reports this scheme reaches 98.41% detection with 0.25% false alarms for initial brand-level access, 97.16% at model level, and 97.54%/96.83% for repetitive access, with a collector mechanism compensating for domains hidden by local DNS caches; a live enterprise deployment is reported at 97.15% detection and 0.097% false alarms.

Load-bearing premise

The method stands or falls on the premise that every time a device joins a network, its built-in components contact a repeatable set of brand-related servers, and that those domain names are visible at the gateway, distinct from background traffic and from other models.

Editorial extensions

If this is right

  • A single gateway deployment can watch for unauthorized mobile devices across internal subnets without installing or maintaining endpoint agents, because the fingerprints are independent of IP addresses.
  • Network operators can learn not only that a device joined but which brand and model it is, turning a security alert into useful inventory information.
  • Repetitive access by the same device stays detectable even when local DNS caches suppress part of the join burst, because the collector reuses a partially covered fingerprint tree.
  • Detection can keep up with live traffic: the paper reports fingerprinting in tens of seconds, testing in a few seconds, and near-97% detection with sub-0.2% false alarms in a production deployment.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An extension the paper leaves unexplored is how much the domain burst of a given model changes across regions or after major OS updates; a cross-region, cross-version test would show whether fingerprint refresh is needed to hold the reported accuracy.
  • Because many phones share the same third-party SDKs, a natural stress test is to pair models that use common chat, payment, or advertising libraries; if their join bursts overlap heavily, the true vendor-specific core of the fingerprint would need to be measured separately.
  • The same dnForest mechanism could be pointed at other device classes such as IoT gadgets or laptops, provided they emit a repeatable domain burst on join; the paper notes that novel classes need a template abstraction, so a practical system would pair this with an unknown-class detector.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes Magnifier, a gateway-level passive detector of mobile-device network access. It builds per-brand and per-model fingerprints (dnForest/dnTree) from DNS, TLS/SSL, and HTTP domain features captured during training traffic, distills those fingerprints with a two-stage weighting scheme, and then matches DNS-triggered tau-second traffic windows against the fingerprints. The evaluation uses a new real-traffic dataset, NetCess2023 (26 models, 7 brands, about 10 GB), and reports DR up to 98.41% at brand level and 97.16% at model level for initial access, and 97.54%/96.83% for repetitive access, all at 0.25% FAR, with comparisons to ETC baselines, an ablation study, a multi-device experiment, and a deployment report. The code and dataset are publicly released.

Significance. If the claimed results hold, Magnifier is a practically valuable contribution: it is endpoint-free, IP-independent, and lightweight enough for online gateway deployment, and it addresses a real gap in network-management tooling. The paper has concrete strengths: real captured traffic, a public dataset, multiple baselines, an ablation isolating the two main components, a computational-cost comparison, and a deployment audit. The central pipeline is not circular by construction, because fingerprints are trained on ScenarioA traffic and matched against independent ScenarioB/C traffic. However, two evaluation-protocol issues—threshold selection on the test set and the unproven event-level interpretation of the reported DR—mean that the magnitude of the claimed accuracy is not yet established; the results may still be correct, but the current evidence is weaker than the headline numbers suggest.

major comments (4)
  1. [Section VI (parameters) and Section VI-E / Figure 7] The operating thresholds epsilon and gamma are selected on the evaluation data and then used for the reported results. Section VI fixes sigma=1, epsilon=0.4, gamma=0.5, and Section VI-E states that these values are chosen because they achieve the best performance in Figure 7, which is computed on SA/SC+SD—the same scenario used for the repetitive-access rows of Table II and the same background set used for all FAR numbers. Tuning on the test set makes the reported DR/FAR optimistic estimates of operating-point behavior. Please select thresholds on a validation set (or via nested cross-validation), or report full curves and clearly label the reported point as the best point on the in-sample sweep.
  2. [Section IV-B and Eq. (9)] The unit on which DR is computed is not defined as a network-access event. A detection window zeta_tau is opened only after observing a DNS request, and Eq. (9) defines DR over a set S without stating whether S contains access events or DNS-triggered tau-second fragments. Table I reports event counts, but the mapping from an event to one or more test samples is never given. If a single join event produces several DNS queries, it is counted multiple times; if it produces no remote DNS (which the paper acknowledges can happen for repetitive access because of local-router DNS cache in Section IV-B), Magnifier opens no window and the event cannot be detected. Please define the sample construction precisely, report the fraction of access events with zero observable DNS, and compute an event-level DR where an event is counted once and a true positive requires that the event is detected.
  3. [Table I and Table II] All reported DR/FAR numbers are single aggregates over 26 models (or 7 brands), and Table I shows large variation in event counts per model (e.g., 214 ScenarioA events for SamsungC5 versus fewer than forty for several models). The headline 97–98% DR therefore does not show whether the method is universal across models, and classes with few events barely influence the aggregate. Please report per-model and per-brand DR/FAR together with confidence intervals, and state the number of test windows/events per class; this is needed to support the claimed 'universality and coverage' in the abstract and Section VII.
  4. [Section VI-C and Eq. (9)] The multi-device evaluation is not fully specified. The paper says traffic from K classes is 'combined,' but does not describe how the DNS-triggered windows from different devices are merged, whether the ground-truth label set is known for every test window, or how Psi(x_i) is defined when several classes pass threshold epsilon; because Eq. (9) requires equality of label sets, the multi-device DR depends on this definition. Please spell out the reconstruction protocol and the exact prediction rule (e.g., set equality, top-K, or thresholded set).
minor comments (6)
  1. [Section V-C] The text says the dataset includes devices from '6 brands' and then immediately lists 7 brands; Table I also shows 7. Please correct the count.
  2. [Section VI-E] There is a duplicated paragraph: the sentences about the trade-off between DR and FAR appear twice. Remove one copy.
  3. [Section VII-B] This subsection is labeled 'Theoretical Analysis' but reports empirical means of confidence scores; please either provide a bound or derivation, or rename the subsection, and report the distribution of confidence scores rather than only the averages.
  4. [Section VII-A / Table V] The two IoT classification baselines, Sivanathan and ProfilIoT, are compared without any description of their features or hyperparameters under the same evaluation protocol; a sentence on how they were adapted would help reproducibility.
  5. [Figure 7] Eight separate panels make the operating-point trade-off hard to read; a single plot with epsilon on the x-axis and DR/FAR curves per gamma would be clearer.
  6. [Section IV-A3 and Definition 2] The node-property notation P_i^y is introduced but never used, and the treatment of nodes shared by multiple decision paths in the count-update step is unspecified; this makes the algorithm hard to reproduce exactly.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity; the fingerprint-matching pipeline is trained and evaluated on separate traffic captures, with only minor evaluation-protocol and self-citation concerns.

full rationale

Magnifier's central derivation is not circular by construction: dnForest fingerprints are built from ScenarioA domain counts (Eqs. 1-5) and matched against independently captured ScenarioB/ScenarioC traffic (Eqs. 7-8), with DR/FAR reported on those separate captures rather than on the fingerprint-construction data. The same-group baseline ProGraph [3] is used only as a comparison system, not as a load-bearing justification, so the self-citation does not create circularity. Two adjacent concerns are real but are evaluation-quality issues rather than equation-level reductions: the operating parameters tau, epsilon, and gamma are illustrated and selected using the same ScenarioB/C plus ScenarioD data that later appears in the headline Table II results, which is a test-set-selection risk; and the Section VII-B 'theoretical analysis' is a post-hoc measurement of the already-trained score function rather than an independent derivation. The paper also candidly acknowledges its limitation on novel classes. None of these makes the fingerprint matching itself equivalent to its inputs, so no circular step is scored.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

Magnifier is a supervised fingerprinting pipeline rather than a derivation, so the ledger is dominated by domain assumptions and tuned hyperparameters. The free parameters are sigma, epsilon, gamma, and tau; epsilon and gamma are selected from sweeps shown in Figure 7 and then used for the headline results, which ties the reported numbers to the evaluation data. The axioms capture the core behavioral assumption that device join bursts are dominated by stable, brand-specific domain names, plus auxiliary assumptions about observability and structural complexity. No new physical entities are postulated.

free parameters (4)
  • sigma (noise tolerance) = 1
    Hyperparameter in Eq. (4) for the decision-path contribution. Set by hand with no sensitivity analysis shown.
  • epsilon (detection threshold) = 0.4
    Selected from the sweep in Figure 7 as the best DR/FAR trade-off. The sweep appears to run on the evaluation setup, so the reported performance may be optimistic.
  • gamma (coverage threshold) = 0.5
    Also selected from the Figure 7 sweep. Controls when the collector assumes a tree is fully covered and collects all its nodes.
  • tau (detection duration) = 15 seconds
    Evaluated at 5, 10, and 15 seconds; the 15 second setting gives the best results and is used for the headline numbers.
assumptions (5)
  • domain assumption Device join bursts are dominated by stable, brand-specific domain names.
    Section IV-A1 states that integrated components and applications attempt to connect to brand-relevant servers every time a device joins. All detection power depends on this repeatability and distinctiveness.
  • domain assumption Domain features are observable despite encryption.
    Section IV-A1 relies on plaintext DNS queries, server names in TLS handshakes and certificates, and hosts in HTTP headers being visible at the gateway.
  • domain assumption Structural complexity of a dnTree indicates proprietary importance.
    Eqs. (3)-(4) and Figure 3 assume that deeper, more complex trees are system-specific while background apps produce simpler trees. This heuristic is not independently validated.
  • domain assumption Collector completeness under partial traffic is safe.
    Section IV-B assumes that if coverage of a major dnTree exceeds gamma, all node values in that tree can be collected. The authors acknowledge this can add background domains and cause false alarms.
  • domain assumption The captured campus and enterprise traffic represents real-world backbone conditions.
    Section V-C describes traffic captured at one campus gateway plus deployment audits. Generalization to other networks, regions, or app ecosystems is not established.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Magnifier: Detecting Network Access via Lightweight Traffic-based Fingerprints." pith.science (2026). https://pith.science/paper/JTJM56GT

@misc{pith2026241213428,
  author       = {Pith},
  title        = {Pith review of: Magnifier: Detecting Network Access via Lightweight Traffic-based Fingerprints},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JTJM56GT}},
  note         = {Machine review of arXiv:2412.13428}
}
read the original abstract

Network access detection plays a crucial role in global network management, enabling efficient network monitoring and topology measurement by identifying unauthorized network access and gathering detailed information about mobile devices. Existing methods for endpoint-based detection primarily rely on deploying monitoring software to recognize network connections. However, the challenges associated with developing and maintaining such systems have limited their universality and coverage in practical deployments, especially given the cost implications of covering a wide array of devices with heterogeneous operating systems. To tackle the issues, we propose Magnifier for mobile device network access detection that, for the first time, passively infers access patterns from backbone traffic at the gateway level. Magnifier's foundation is the creation of device-specific access patterns using the innovative Domain Name Forest (dnForest) fingerprints. We then employ a two-stage distillation algorithm to fine-tune the weights of individual Domain Name Trees (dnTree) within each dnForest, emphasizing the unique device fingerprints. With these meticulously crafted fingerprints, Magnifier efficiently infers network access from backbone traffic using a lightweight fingerprint matching algorithm. Our experimental results, conducted in real-world scenarios, demonstrate that Magnifier exhibits exceptional universality and coverage in both initial and repetitive network access detection in real-time. To facilitate further research, we have thoughtfully curated the NetCess2023 dataset, comprising network access data from 26 different models across 7 brands, covering the majority of mainstream mobile devices. We have also made both the Magnifier prototype and the NetCess2023 dataset publicly available\footnote{https://github.com/SecTeamPolaris/Magnifier}.

Figures

Figures reproduced from arXiv: 2412.13428 by the authors.

Figure 1
Figure 1. Two types of methods for network access detection. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The framework of Magnifier. network traffic analysis.Whenever a device connects to the net￾work, communication traffic becomes visible on the gateway as long as the device establishes a connection with a remote server. To address this, a detector must perform comprehensive traffic monitoring at the gateway with fine-grained detection capabilities and rapid response times, since network access bursts are unpredictabl… view at source ↗
Figure 3
Figure 3. An example of major dnTree and background dnTrees constructed [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Real-time network access detection of Magnifier. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Traffic capturing in real-world scenarios of NetCess2023. [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Comparison on computational consumption. [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Evaluations with different settings of detection threshold [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

48 extracted references · 41 canonical work pages

  1. [1]

    A survey on encrypted traffic classification,

    Z. Cao and Xiong, “A survey on encrypted traffic classification,” in International Conference on Applications and Techniques in Information Security. Springer, 2014, pp. 73–81

    work page 2014

  2. [2]

    On inferring application protocol behaviors in encrypted network traffic

    C. V . Wright, “On inferring application protocol behaviors in encrypted network traffic.” Journal of Machine Learning Research , vol. 7, no. 12, 2006

    work page 2006

  3. [3]

    Prograph: Ro- bust network traffic identification with graph propagation,

    W. Li, X.-Y . Zhang, H. Bao, H. Shi, and Q. Wang, “Prograph: Ro- bust network traffic identification with graph propagation,” IEEE/ACM Transactions on Networking , vol. 31, no. 3, pp. 1385–1399, 2023

    work page 2023

  4. [4]

    Analyzing the security mech- anisms to prevent unauthorized access in cloud and network security,

    K. Maithili, V . Vinothkumar, and P. Latha, “Analyzing the security mech- anisms to prevent unauthorized access in cloud and network security,” Journal of Computational and Theoretical Nanoscience, vol. 15, no. 6-7, pp. 2059–2063, 2018

    work page 2018

  5. [5]

    On fast and accurate detection of unauthorized wireless access points using clock skews,

    S. Jana and S. K. Kasera, “On fast and accurate detection of unauthorized wireless access points using clock skews,” in Proceedings of the 14th ACM international conference on Mobile computing and networking , 2008, pp. 104–115

    work page 2008

  6. [6]

    Tactical provenance analysis for endpoint detection and response systems,

    W. U. Hassan, A. Bates, and D. Marino, “Tactical provenance analysis for endpoint detection and response systems,” in 2020 IEEE Symposium on Security and Privacy (SP) . IEEE, 2020, pp. 1172–1189

    2020

  7. [7]

    Endpoint detection and response: Why use machine learning?

    N. N. A. Sjarif, S. Chuprat, M. N. Mahrin, N. A. Ahmad, A. Ariffin, F. M. Senan, N. A. Zamani, and A. Saupi, “Endpoint detection and response: Why use machine learning?” in 2019 International Conference on Information and Communication Technology Convergence (ICTC) . IEEE, 2019, pp. 283–288

    work page 2019

  8. [8]

    Robust network traffic identification with graph matching,

    W. Li, X.-Y . Zhang, H. Bao, Q. Wang, and Z. Li, “Robust network traffic identification with graph matching,” Computer Networks , vol. 218, p. 109368, 2022

    work page 2022

Show all 48 references
  1. [9]

    Symtcp: eluding stateful deep packet inspection with automated discrepancy discovery,

    Z. Wang and S. Zhu, “Symtcp: eluding stateful deep packet inspection with automated discrepancy discovery,” in Network and Distributed System Security Symposium, NDSS 2020 , 2020

    2020

  2. [10]

    Evolving deep learning architectures for network intrusion detection using a double pso meta- heuristic,

    W. Elmasry, A. Akbulut, and A. H. Zaim, “Evolving deep learning architectures for network intrusion detection using a double pso meta- heuristic,” Computer Networks, vol. 168, p. 107042, 2020

    2020

  3. [11]

    Flowprint: Semi-supervised mobile-app fingerprinting on encrypted network traf- fic,

    T. van Ede, R. Bortolameotti, A. Continella, J. Ren, D. J. Dubois, M. Lindorfer, D. Choffnes, M. van Steen, and A. Peter, “Flowprint: Semi-supervised mobile-app fingerprinting on encrypted network traf- fic,” in Network and Distributed System Security Symposium, NDSS

  4. [12]

    A survey of methods for encrypted traffic clas- sification and analysis,

    P. Velan and ˇCerm´ak, “A survey of methods for encrypted traffic clas- sification and analysis,” International Journal of Network Management , vol. 25, no. 5, pp. 355–374, 2015

    2015

  5. [13]

    Mampf: Encrypted traffic classification based on multi- attribute markov probability fingerprints,

    C. Liu and Cao, “Mampf: Encrypted traffic classification based on multi- attribute markov probability fingerprints,” in IWQoS. IEEE, 2018, pp. 1–10

    2018

  6. [14]

    From the dialectical perspective: Modeling and exploiting of hybrid worm propagation,

    T. Wang, H. Li, C. Xia, H. Zhang, and P. Zhang, “From the dialectical perspective: Modeling and exploiting of hybrid worm propagation,” IEEE Transactions on Information Forensics and Security , vol. 18, pp. 1610–1624, 2023

    2023

  7. [15]

    Detecting and blocking unauthorized access in wi-fi networks,

    H. Xia and J. Brustoloni, “Detecting and blocking unauthorized access in wi-fi networks,” in International Conference on Research in Networking. Springer, 2004, pp. 795–806

    2004

  8. [16]

    Airshark: detecting non-wifi rf devices using commodity wifi hardware,

    S. Rayanchu, A. Patro, and S. Banerjee, “Airshark: detecting non-wifi rf devices using commodity wifi hardware,” in Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference, 2011, pp. 137–154

    2011

  9. [17]

    Wigest: A ubiquitous wifi-based gesture recognition system,

    H. Abdelnasser, M. Youssef, and K. A. Harras, “Wigest: A ubiquitous wifi-based gesture recognition system,” in 2015 IEEE conference on computer communications (INFOCOM) . IEEE, 2015, pp. 1472–1480

    2015

  10. [18]

    Robust network traffic classification,

    J. Zhang and Chen, “Robust network traffic classification,” IEEE/ACM transactions on networking , vol. 23, no. 4, pp. 1257–1270, 2014

    2014

  11. [19]

    Cross-silo horizontal federated learning for flow-based time-related-features oriented traffic classifica- tion,

    U. Majeed, L. U. Khan, and C. S. Hong, “Cross-silo horizontal federated learning for flow-based time-related-features oriented traffic classifica- tion,” in APNOMS. IEEE, 2020, pp. 389–392

    2020

  12. [20]

    Encrypted traffic classification with a convolutional long short-term memory neu- ral network,

    Z. Zou, J. Ge, H. Zheng, Y . Wu, C. Han, and Z. Yao, “Encrypted traffic classification with a convolutional long short-term memory neu- ral network,” in 2018 IEEE 20th International Conference on High Performance Computing and Communications; IEEE 16th International Conference...

    2018

  13. [21]

    Tree-rnn: Tree structural recurrent neural network for network traffic classification,

    X. Ren, H. Gu, and W. Wei, “Tree-rnn: Tree structural recurrent neural network for network traffic classification,” Expert Systems with Applications, vol. 167, p. 114363, 2021

    2021

  14. [22]

    Prism: Real-time privacy protection against temporal network traffic analyzers,

    W. Li, X.-Y . Zhang, H. Bao, B. Yang, Z. Li, H. Shi, and Q. Wang, “Prism: Real-time privacy protection against temporal network traffic analyzers,” IEEE Transactions on Information Forensics and Security , 2023

    2023

  15. [23]

    Deep learning for encrypted traffic classification in the face of data drift: An empirical study,

    N. Malekghaini, E. Akbari, M. A. Salahuddin, N. Limam, R. Boutaba, B. Mathieu, S. Moteau, and S. Tuffin, “Deep learning for encrypted traffic classification in the face of data drift: An empirical study,” Computer Networks, vol. 225, p. 109648, 2023

    2023

  16. [24]

    Few shot learning approaches for classifying rare mobile-app encrypted traffic samples,

    G. Bovenzi, D. Di Monda, A. Montieri, V . Persico, and A. Pescap´e, “Few shot learning approaches for classifying rare mobile-app encrypted traffic samples,” in IEEE INFOCOM 2023-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) . IEEE, 2023, pp. 1–6

    2023

  17. [25]

    Glads: A global-local attention data selection model for multimodal multitask encrypted traffic classification of iot,

    J. Dai, X. Xu, and F. Xiao, “Glads: A global-local attention data selection model for multimodal multitask encrypted traffic classification of iot,” Computer Networks, vol. 225, p. 109652, 2023

    2023

  18. [26]

    Datanet: Deep learning based encrypted network traffic classification in sdn home gateway,

    P. Wang, F. Ye, X. Chen, and Y . Qian, “Datanet: Deep learning based encrypted network traffic classification in sdn home gateway,” IEEE Access, vol. 6, pp. 55 380–55 391, 2018

    2018

  19. [27]

    Tls/ssl encrypted traffic classification with autoencoder and convolutional neural network,

    Y . Yang, C. Kang, G. Gou, Z. Li, and G. Xiong, “Tls/ssl encrypted traffic classification with autoencoder and convolutional neural network,” in HPCC/SmartCity/DSS. IEEE, 2018, pp. 362–369

    2018

  20. [28]

    A deep learning based method for handling imbalanced problem in network traffic classification,

    L. Vu, C. T. Bui, and Q. U. Nguyen, “A deep learning based method for handling imbalanced problem in network traffic classification,” in Proceedings of the Eighth International Symposium on Information and Communication Technology, 2017, pp. 333–339

    2017

  21. [29]

    Learning to classify: A flow- based relation network for encrypted traffic classification,

    W. Zheng, C. Gou, L. Yan, and S. Mo, “Learning to classify: A flow- based relation network for encrypted traffic classification,” in Proceed- ings of The Web Conference 2020 , 2020, pp. 13–22

    2020

  22. [30]

    Detecting unknown encrypted malicious traffic in real time via flow interaction graph analysis,

    C. Fu, Q. Li, and K. Xu, “Detecting unknown encrypted malicious traffic in real time via flow interaction graph analysis,” arXiv preprint arXiv:2301.13686, 2023

    2023 arXiv

  23. [31]

    Et-bert: A contextualized datagram representation with pre-training transformers for encrypted traffic classification,

    X. Lin, G. Xiong, G. Gou, Z. Li, J. Shi, and J. Yu, “Et-bert: A contextualized datagram representation with pre-training transformers for encrypted traffic classification,” in Proceedings of the ACM Web Conference 2022, 2022, pp. 633–642

    2022

  24. [32]

    Appsniffer: Towards robust mobile app fingerprinting against vpn,

    S. Oh, M. Lee, H. Lee, E. Bertino, and H. Kim, “Appsniffer: Towards robust mobile app fingerprinting against vpn,” in Proceedings of the ACM Web Conference 2023 , 2023, pp. 2318–2328

    2023

  25. [33]

    Tfe-gnn: A temporal fusion encoder using graph neural networks for fine-grained encrypted traffic classification,

    H. Zhang, L. Yu, X. Xiao, Q. Li, F. Mercaldo, X. Luo, and Q. Liu, “Tfe-gnn: A temporal fusion encoder using graph neural networks for fine-grained encrypted traffic classification,” in Proceedings of the ACM Web Conference 2023, 2023, pp. 2066–2075

    2023

  26. [34]

    Efficient and low overhead website fingerprinting attacks and defenses based on tcp/ip traffic,

    G. Huang, C. Ma, M. Ding, Y . Qian, C. Ge, L. Fang, and Z. Liu, “Efficient and low overhead website fingerprinting attacks and defenses based on tcp/ip traffic,” in Proceedings of the ACM Web Conference 2023, 2023, pp. 1991–1999

    2023

  27. [35]

    Poster: Traffic splitting to counter website fingerprinting,

    W. De la Cadena, A. Mitseva, J. Pennekamp, J. Hiller, F. Lanze, T. Engel, K. Wehrle, and A. Panchenko, “Poster: Traffic splitting to counter website fingerprinting,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security , 2019, pp. 2533–2535

    2019

  28. [36]

    Trafficsliver: Fighting website fingerprinting attacks with traffic splitting,

    W. De la Cadena, A. Mitseva, J. Hiller, J. Pennekamp, S. Reuter, J. Filter, T. Engel, K. Wehrle, and A. Panchenko, “Trafficsliver: Fighting website fingerprinting attacks with traffic splitting,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications S...

    2020

  29. [37]

    Fs-net: A flow sequence network for encrypted traffic classification,

    C. Liu, L. He, G. Xiong, Z. Cao, and Z. Li, “Fs-net: A flow sequence network for encrypted traffic classification,” in IEEE INFOCOM 2019- IEEE Conference on Computer Communications . IEEE, 2019, pp. 1171–1179

    2019

  30. [38]

    Mbtree: detecting encryption rats communication using malicious behavior tree,

    C. Dong, Z. Lu, Z. Cui, B. Liu, and K. Chen, “Mbtree: detecting encryption rats communication using malicious behavior tree,” IEEE Transactions on Information Forensics and Security , 2021

    2021

  31. [39]

    A method of few-shot network intrusion detection based on meta-learning framework,

    C. Xu, J. Shen, and X. Du, “A method of few-shot network intrusion detection based on meta-learning framework,” IEEE Transactions on Information Forensics and Security , 2020

    2020

  32. [40]

    Mcre: A unified framework for handling malicious traffic with noise labels based on multidimensional constraint representation,

    Q. Yuan, G. Gou, Y . Zhu, Y . Zhu, G. Xiong, and Y . Wang, “Mcre: A unified framework for handling malicious traffic with noise labels based on multidimensional constraint representation,” IEEE Transactions on Information Forensics and Security , 2023. MAGNIFIER: DETECTING NET...

    2023

  33. [41]

    Wf-transformer: Learning temporal features for accurate anonymous traffic identification by using transformer networks,

    Q. Zhou, L. Wang, H. Zhu, T. Lu, and V . Sheng, “Wf-transformer: Learning temporal features for accurate anonymous traffic identification by using transformer networks,” IEEE Transactions on Information Forensics and Security, pp. 1–1, 2023

    2023

  34. [42]

    Application identification via network traffic classification,

    B. Yamansavascilar, M. A. Guvensan, A. G. Yavuz, and M. E. Karsligil, “Application identification via network traffic classification,” in 2017 In- ternational Conference on Computing, Networking and Communications (ICNC), 2017

    2017

  35. [43]

    A machine learning approach for efficient traf- fic classification,

    W. Li and A. W. Moore, “A machine learning approach for efficient traf- fic classification,” in 2007 15th International symposium on modeling, analysis, and simulation of computer and telecommunication systems , 2007

    2007

  36. [44]

    Xgboost: A scalable tree boosting system,

    T. Chen and C. Guestrin, “Xgboost: A scalable tree boosting system,” in Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining , 2016, pp. 785–794

    2016

  37. [45]

    Deep learning for network traffic classification,

    N. Bayat, W. Jackson, and D. Liu, “Deep learning for network traffic classification,” arXiv preprint arXiv:2106.12693 , 2021

    2021 arXiv

  38. [46]

    Classifying iot devices in smart environments using network traffic characteristics,

    A. Sivanathan, H. H. Gharakheili, F. Loi, A. Radford, C. Wijenayake, A. Vishwanath, and V . Sivaraman, “Classifying iot devices in smart environments using network traffic characteristics,” IEEE Transactions on Mobile Computing , vol. 18, no. 8, pp. 1745–1759, 2018

    2018

  39. [47]

    Profiliot: A machine learning approach for iot device identification based on network traffic analysis,

    Y . Meidan, M. Bohadana, A. Shabtai, J. D. Guarnizo, M. Ochoa, N. O. Tippenhauer, and Y . Elovici, “Profiliot: A machine learning approach for iot device identification based on network traffic analysis,” in Proceedings of the symposium on applied computing , 2017, pp. 506– 509

    2017

  40. [2020]

    Internet Society, 2020

    2020

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.