Pith. sign in

REVIEW 3 major objections 5 minor 53 references

Cruise Control: Dynamic Model Selection for ML-Based Network Traffic Analysis

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A monitoring system that switches ML models on packet-loss signals improves median accuracy by 2.78% and cuts packet loss fourfold versus static selection.

desk verdict Real systems work with credible loss numbers, but the headline accuracy gain is an offline proxy, not a measured result. read the letter →

arxiv 2412.15146 v2 pith:SMPSYSIC submitted 2024-12-19 cs.NI

Johann Hugon , Paul Schmitt , Anthony Busson , Francesco Bronzino This is my paper · ORCID
classification cs.NI
keywords dynamicmodelselectionnetworktrafficanalysispacketlossfeatureextractionAIMDcontrolMLinferencepipelinesvideoqualityservicerecognition
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a network monitoring system need not commit to a single ML model and feature set for traffic analysis. Instead, the system can keep a ranked ladder of models with different accuracy and CPU costs, watch one cheap signal—packet loss—and move up or down the ladder as load changes, much like TCP adjusts its sending rate. On two real-world tasks (video quality inference and service recognition), the authors report that this dynamic selection improves median accuracy by 2.78% while reducing packet loss by a factor of four compared with static, offline-selected models. If true, operators could stop configuring for worst-case traffic and let the monitoring server continuously adapt its processing cost.

What carries the argument

The load-bearing mechanism is the AIMD selection loop in Algorithm 1. It indexes feature sets in increasing cost and accuracy; each time the hardware reports a dropped packet, it multiplies the index by a decay factor to jump to a cheaper set, and every monitoring window with no drops it increments the index by one to try a richer set. Around that loop sits a runtime design that makes switching practical: a worker/backup-worker swap lets per-flow feature maps be exported to the post-processor without halting traffic, and feature sets are encoded as bit masks so parallel tasks can be merged by a bitwise OR and computed once.

What would settle it

Replay a labeled traffic trace with ground-truth video-quality or service labels through Cruise Control while injecting the same bursty-loss patterns, computing realized inference accuracy on the actually extracted features. If the realized median accuracy gain over static configurations does not reproduce the claimed 2.78% improvement, the offline-accuracy proxy is the failure point.

Watch

Extended reading notes

Core claim

The central claim is that dynamic, loss-triggered model selection beats any single static choice in the accuracy-versus-loss tradeoff. Given a Pareto-optimal family of feature sets and models, Cruise Control derives the current overload state from the NIC's packet-drop counter and applies additive-increase/multiplicative-decrease to the model index: a drop immediately downgrades to a cheaper feature set, while steady periods periodically upgrade to a more accurate one. In trace-driven experiments spanning night/noon/evening load profiles and a steady one-hour trace, the system reports median accuracy at least as high as the best static configuration that avoids catastrophic loss, with 0.37% loss versus 9%+ for heavier static models in the video task, and a factor-of-four loss reduction overall. The authors are explicit that the CAIDA traffic used is unlabeled, so 'accuracy' is the offline-measured accuracy of the feature set actually produced, not directly measured inference accuracy on the live trace.

Load-bearing premise

The load-bearing premise is that the offline per-feature-set accuracies remain the realized accuracies on replayed live traffic even under packet loss; Section 5.1 uses unlabeled CAIDA traffic, so the reported 'accuracy' is the offline mapping from extracted features to expected performance, not a directly measured inference gain.

Editorial extensions

If this is right

  • Network operators can deploy a pool of models with different accuracy-cost tradeoffs and let runtime load decide, removing the need to know the deployment environment in advance.
  • During traffic spikes the system sheds feature-extraction cost within moments of the first drop, and during quiet periods it climbs back to more accurate models.
  • Running several analysis tasks in parallel no longer requires separate servers because shared features are extracted once via bitwise-OR merging.
  • The evaluation's claimed factor-of-four packet-loss reduction and 2.78% median accuracy gain would translate to more reliable real-time monitoring at equal or lower compute cost.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The AIMD formulation invites direct borrowing from congestion-control theory: the model index behaves like a congestion window, so variants such as slow-start probing or explicit overload signals could improve how quickly Cruise Control converges to the right feature set.
  • Because the offline accuracy ladder is the only accuracy signal, the method's ultimate gain depends on those offline accuracies remaining valid for the live traffic mix; a labeled live trace with ground-truth labels would quantify this directly.
  • The same cost-accuracy ladder plus a cheap saturation signal could apply outside network monitoring, for example to edge video analytics or stream processing where input rate varies and inference accuracy varies with feature richness.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper presents Cruise Control, a DPDK-based system for dynamically selecting among pre-trained ML feature sets / models for network traffic analysis. The system monitors hardware rx queue drops and uses an AIMD-style rule to move between ranked feature-set configurations, with a backup-worker mechanism to avoid loss during feature export. The authors evaluate on two tasks (video quality inference and service recognition) using CAIDA traces replayed with TRex on a 100GbE testbed, comparing against static configurations from Retina/CATO. The paper's central claim, in the abstract and Section 1, is that Cruise Control improves median task accuracy by 2.78% while reducing packet loss by a factor of four compared to statically-selected models.

Significance. The systems contribution is timely and potentially useful: dynamic, loss-triggered selection of feature-extraction cost is a plausible way to avoid worst-case overprovisioning of ML monitoring pipelines. The packet-loss measurements are real, the testbed is substantial (100GbE, real traces), the comparison against static baselines is appropriate, and the authors state that the source code will be released. These are concrete strengths. However, the headline accuracy improvement is not an end-to-end measurement: Section 5.1 explicitly says that CAIDA traffic is unlabeled and that 'accuracy' is an offline per-feature-set value assigned to the selected configuration. Because packet loss degrades different feature sets differently (shown in Table 1), the reported 2.78% median accuracy gain is a proxy, not evidence of realized inference gains on the evaluation trace. The accuracy half of the central claim needs to be either re-measured or substantially reframed.

major comments (3)
  1. [§5.1, abstract, §1] The central claim that Cruise Control 'improves median task accuracy by 2.78%' is not supported as stated. Section 5.1 says: 'since CAIDA traffic is unlabeled, we cannot directly evaluate machine learning model performance... Instead, "accuracy" represents the relationship between extracted features and expected model performance as determined in the offline phase.' Consequently, every accuracy figure in Figure 6 and Tables 4–5 is the offline accuracy of the feature set selected by the system, not a measurement made on the replayed trace. The paper's own Table 1 shows that packet loss affects feature sets very differently (e.g., at p1=0.001, p2=0.1, Transport MAE jumps to 6279.5 ms versus 1785.4 ms for Network). Since Cruise Control and the static baselines experience different loss patterns, substituting offline accuracy for realized accuracy can change both the magnitude and the sign of the claimed improvement. The authors should either measure realized accuracy on a labeled trace with loss, or reframe the claim as an offline-accuracy proxy and remove the 2.78% figure from the abstract and introduction.
  2. [§5.5, §5.1] The mon_window parameter is tuned on the same one-hour CAIDA trace used for the main evaluation. Table 8 reports that mon_window = 8 seconds is 'optimal' for this trace, and the authors state this value is used in all other experiments. This is selection on the test data: the loss and accuracy numbers in §5.1–§5.4 are therefore conditional on a parameter chosen from the evaluation trace itself, which can make the results optimistic. The authors should tune on a separate trace, or at minimum demonstrate that the conclusions are robust across a range of mon_window values not chosen on the test trace.
  3. [§5.1, Figure 7d] The text claims that when Cruise Control downgrades to m1 during the evening load, it 'performing even better than m2' because it avoids packet loss. This is not demonstrated. m1 has the lowest offline accuracy (0.799 vs. m2's 0.900), and no realized accuracy is measured on the trace. The statement is only coherent under the unmeasured assumption that loss degrades m2 below m1's offline accuracy. This is exactly the kind of inference the paper's unlabeled-trace methodology cannot support; please either provide evidence or rephrase to say that Cruise Control avoids loss while its offline accuracy is lower than m2's.
minor comments (5)
  1. [§5, Hardware environment] There are typos: 'split accros two NUMA' should be 'split across two NUMA nodes' and 'accros' appears again in the next sentence.
  2. [§6, Related Work] In the paragraph on Liu et al., 'they solely focus ib early application identification' should be 'they solely focus on early application identification'.
  3. [Figure 6 caption] The caption contains 'maximum accuracy with zero packet packet loss'; the duplicated 'packet' should be removed.
  4. [Figure 6] The x-axis labels are inconsistent: the top panel shows '0 20 40' while the bottom panel shows '0 10' with no axis title; please align the axes and label the x-axis as 'Packet loss (%)' consistently.
  5. [§5.2, Table 4] The 'No Export' row is described as 'scaled-down experiment limited by available RAM' using five minutes of traffic; please state explicitly how this shorter trace relates to the one-hour trace and whether it is the same trace prefix.

Circularity Check

1 steps flagged · score 6.0 of 10

The reported accuracy improvement reduces to the offline accuracy table that is the system's input; packet-loss reduction is measured and independent.

  1. fitted input called prediction [Abstract; Section 5.1 (Performance Under Varying Workloads)]
    ""Our evaluation shows that Cruise Control improves median accuracy by 2.78% while reducing packet loss by a factor of four compared to offline-selected models." (Abstract) "Note that, since CAIDA traffic is unlabeled, we cannot directly evaluate machine learning model performance—which is beyond the scope of this paper. Instead, 'accuracy' represents the relationship between extracted features and expected model performance as determined in the offline phase (Section 3)." (Section 5.1)"

    The 2.78% median accuracy improvement is computed from the same offline accuracy table (Tables 2 and 3) that is given as Cruise Control's input configuration. Section 5.1 states that CAIDA traffic is unlabeled and 'accuracy' is the offline relationship, so every online accuracy value is simply the Acc column entry of the feature set selected by Algorithm 1. Consequently, the accuracy difference between Cruise Control and a static model is, by construction, the difference between two entries in that fitted input table, not a measured inference-quality result on the evaluation trace. The selection algorithm changes which table entry is reported, so the accuracy gain is an artifact of the lookup; only the packet-loss figures are independently measured.

full rationale

Cruise Control's measurable, system-level contribution is the packet-loss reduction, which is obtained from runtime counters and is not circular. The accuracy half of the central claim, however, is not an end-to-end measurement. Section 5.1 explicitly substitutes the offline accuracy of the selected feature set for realized accuracy on the unlabeled CAIDA replay. Because the same offline accuracy table is the input configuration that the selection algorithm navigates (Tables 2-3), the reported median accuracy of Cruise Control is a lookup of the Acc column for whatever model the AIMD policy selects, and the reported gain over a static model is the difference between two entries in that same input table. This is a fitted input presented as a prediction: the offline accuracies were fit to labeled data, and the online 'accuracy' is just the offline value re-attached to the selected feature set. The paper is transparent about this limitation, which is why this is partial circularity (6) rather than a fully forced result (8). The self-citations to CATO and Bronzino et al. are not load-bearing in a circular way: they supply the input Pareto front and feature sets, and the paper explicitly states alternatives could be used. The concern is the evaluation claim, not the derivation structure.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The main evaluation rests on three categories of assumptions: offline accuracy transfer, the rx_miss signal as a faithful overload indicator, and the representativeness of the replayed CAIDA profiles. The only tunable parameters that materially affect the headline numbers are mon_window and dec_factor; mon_window is tuned on the same trace used for evaluation.

free parameters (3)
  • mon_window = 8 seconds (on 1-hour CAIDA trace)
    Controls how often the system tries a more complex feature set; Section 5.5 scans values and selects 8 seconds as optimal, then this value is used in the main evaluation. Tuned in-sample on the same trace family used for headline results.
  • dec_factor = 0.5 (example, not systematically varied)
    Multiplicative decrease applied to model index on packet loss in Algorithm 1; the paper fixes it at 0.5 in the example and does not report a sensitivity analysis.
  • export_window = not reported precisely
    Interval between worker hashmap exports affects overhead and loss; described qualitatively in Section 3.2 and Section 5.2 without exact values or tuning procedure.
assumptions (4)
  • domain assumption Offline model accuracy per feature set transfers to live replayed traffic, including under packet loss.
    Section 5.1 states CAIDA traffic is unlabeled and 'accuracy' is taken from the offline phase; this makes the accuracy gains an assumption rather than a measurement.
  • domain assumption The rx_miss counter reflects compute overload of the pipeline.
    Section 3.3 monitors NIC rx_miss drops as the only overload signal; drops could also be caused by NIC scheduling, RSS imbalance, or memory pressure.
  • domain assumption CAIDA 2016 trace replay with TRex scaling represents realistic deployment conditions.
    Section 5 uses three profiles scaled by ratios from Feldmann et al.; representativeness for other networks is assumed.
  • domain assumption CATO's offline Pareto-front cost and accuracy estimates remain valid at runtime on the testbed.
    Tables 2 and 3 derive model order from CATO applied to Bronzino et al. features; dynamic switching assumes this order is monotonic in real processing cost.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Cruise Control: Dynamic Model Selection for ML-Based Network Traffic Analysis." pith.science (2026). https://pith.science/paper/SMPSYSIC

@misc{pith2026241215146,
  author       = {Pith},
  title        = {Pith review of: Cruise Control: Dynamic Model Selection for ML-Based Network Traffic Analysis},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SMPSYSIC}},
  note         = {Machine review of arXiv:2412.15146}
}
read the original abstract

Modern networks increasingly rely on machine learning models for real-time insights, including traffic classification, application quality of experience inference, and intrusion detection. However, existing approaches prioritize prediction accuracy without considering deployment constraints or the dynamism of network traffic, leading to potentially suboptimal performance. Because of this, deploying ML models in real-world networks with tight performance constraints remains an open challenge. In contrast with existing work that aims to select an optimal candidate model for each task based on offline information, we propose an online, system-driven approach to dynamically select the best ML model for network traffic analysis. To this end, we present Cruise Control, a system that pre-trains several models for a given task with different accuracy-cost tradeoffs and selects the most appropriate model based on lightweight signals representing the system's current traffic processing ability. Experimental results using two real-world traffic analysis tasks demonstrate Cruise Control's effectiveness in adapting to changing network conditions. Our evaluation shows that Cruise Control improves median accuracy by 2.78% while reducing packet loss by a factor of four compared to offline-selected models.

Figures

Figures reproduced from arXiv: 2412.15146 by the authors.

Figure 1
Figure 1. Comparison of the impact of three different [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Cruise Control system overview. Model # Cost Acc. 𝑚9 2272 0.935 𝑚8 1696 0.934 𝑚7 1248 0.933 𝑚6 960 0.932 𝑚5 736 0.931 𝑚4 704 0.926 𝑚3 480 0.924 𝑚2 320 0.900 𝑚1 256 0.799 0 2000 4000 Estimate cost (CPU cycles/packet) 0.65 0.70 0.75 0.80 0.85 0.90 0.95 Accuracy Pareto Front Models Other Models 1 2 3 4 5 6 7 8 9 10 # Features [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Video quality infer￾ence Pareto front. tion module handles packet processing, connection reassem￾bly, feature extraction, and the computation of statistical features required for ML model execution. The Model Selec￾tion module gathers metrics to monitor system performance and determines the set of features to be collected for the target model. We describe the Model Selection module in Section 3.3. Packet processing … view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Timeseries of Cruise Control model selection algorithm. The blue line represents the selected feature set, while the red line shows the number of dropped packets over time. set to 0.5, the algorithm switches from feature set 𝑚9 to 𝑚4. When a second drop occurs at 132 s…
Figure 5
Figure 5. Figure 5: Service recognition Pareto front. packets, with the first packet carrying particular significance due to memory structure initialization costs. We apply the same Pareto front methodology as in the previous use case. We utilize six features from the video quality analys…
Figure 6
Figure 6. Figure 6: Different time of day workload display model accuracy (blue/left y-axis) and packet losses (red/right y-axis) throughout the experiment. With the 𝑚3 static feature set, minimal drops occur during the ’noon’ traf￾fic profile (0-600 seconds), primarily coinciding with ex…
Figure 7
Figure 7. Figure 7: Timeseries for static feature sets and Cruise Control for video quality inference # Parallel Workers 0.5 Mcps 1.0 Mcps 1.5 Mcps 2.0 Mcps 2.5 Mcps 3.0 Mcps 4.0 Mcps 6.0 Mcps 8.0 Mcps 1 0.00 0.00 0.79 23.87 30.39 40.13 55.73 70.48 77.62 2 0.00 0.00 0.00 0.00 0.00 2.90 23…
Figure 8
Figure 8. Figure 8: Service recognition features extraction across three different network load [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

53 extracted references · 33 canonical work pages

  1. [1]

    Data Plane Development Kit

    2023. Data Plane Development Kit. https://www.dpdk.org/

    work page 2023

  2. [2]

    TRex, Realistic Traffic Generator

    2023. TRex, Realistic Traffic Generator. https://trex-tgn.cisco.com

    work page 2023

  3. [4]

    Zeeshan Ahmad, Adnan Shahid Khan, Cheah Wai Shiang, Johari Ab- dullah, and Farhan Ahmad. 2021. Network intrusion detection system: A systematic study of machine learning and deep learning approaches. Transactions on Emerging Telecommunications Technologies32, 1 (2021), e4150

    work page 2021

  4. [5]

    Salahuddin, Leni Ven, Noura Limam, Raouf Boutaba, Bertrand Mathieu, Stephanie Moteau, and Stephane Tuffin

    Iman Akbari, Mohammad A. Salahuddin, Leni Ven, Noura Limam, Raouf Boutaba, Bertrand Mathieu, Stephanie Moteau, and Stephane Tuffin. 2021. A Look Behind the Curtain: Traffic Classification in an Increasingly Encrypted Web. Proc. ACM Meas. Anal. Comput. Syst. 5, 1, Article 04 (Feb. 2021), 26 pages. doi:10.1145/3447382

    doi:10.1145/3447382 2021

  5. [6]

    Aristide Tanyi-Jong Akem, Guillaume Fraysse, and Marco Fiore. 2024. Encrypted Traffic Classification at Line Rate in Programmable Switches with Machine Learning. InNOMS 2024-2024 IEEE Network Operations and Management Symposium

    work page 2024

  6. [7]

    Rushi Jayeshkumar Babaria, Minzhao Lyu, Gustavo Batista, and Vijay Sivaraman. 2025. FastFlow: Early Yet Robust Network Flow Classifica- tion using the Minimal Number of Time-Series Packets.Proceedings of the ACM on Measurement and Analysis of Computing Systems (2025)

    work page 2025

  7. [8]

    Katsikas, Geor- gios P

    Tom Barbette, Tom Barbette, Tom Barbette, Georgios P. Katsikas, Geor- gios P. Katsikas, Gerald Q. Maguire, Gerald Q. Maguire Jr., Dejan Kostić, and Dejan Kostic. 2019. RSS++: load and state-aware receive side scal- ing. Conference on Emerging Network Experiment and Technology(2019). doi:10.1145/3359989.3365412

    arXiv 2019

  8. [9]

    Laurent Bernaille, Renata Teixeira, and Kavé Salamatian. 2006. Early Application Identification. In International Conference on Emerging Networking Experiments and Technologies (CoNEXT)

    work page 2006

Show all 53 references
  1. [10]

    Salahuddin, Noura Limam, Sara Ayoubi, Nashid Shahriar, Felipe Estrada-Solano, and Oscar M

    Raouf Boutaba, Mohammad A. Salahuddin, Noura Limam, Sara Ayoubi, Nashid Shahriar, Felipe Estrada-Solano, and Oscar M. Caicedo. 2018. A comprehensive survey on machine learning for networking: evolution, applications and research opportunities. InJournal of Internet Services an...

    2018

  2. [11]

    Francesco Bronzino, Paul Schmitt, Sara Ayoubi, Hyojoon Kim, Renata Teixeira, and Nick Feamster. 2021. Traffic refinery: Cost-aware data representation for machine learning on network traffic. Proceedings of the ACM on Measurement and Analysis of Computing Systems 5, 3 (2021), 1–24

    2021

  3. [12]

    Francesco Bronzino, Paul Schmitt, Sara Ayoubi, Guilherme Martins, Renata Teixeira, and Nick Feamster. 2019. Inferring Streaming Video Quality from Encrypted Traffic: Practical Models and Deployment Experience. In Proceedings of the ACM on Measurement and Analysis of Computing Systems

    2019

  4. [13]

    Coralie Busse-Grawitz, Roland Meier, Alexander Dietmüller, Tobias Bühler, and Laurent Vanbever. 2022. pForest: In-Network Inference with Random Forests. arXiv:1909.05680 [cs.NI] https://arxiv.org/abs/ 1909.05680

    2022 arXiv

  5. [14]

    Qizhe Cai, Shubham Chaudhary, Midhul Vuppalapati, Jaehyun Hwang, and Rachit Agarwal. 2021. Understanding host network stack over- heads. In Proceedings of the 2021 ACM SIGCOMM 2021 Conference (Vir- tual Event, USA)(SIGCOMM ’21). Association for Computing Machin- ery, New York,...

    2021

  6. [15]

    CAIDA. 2016. CAIDA Anonymized Internet Traces 2016 Dataset. https://www.caida.org/data/passive/passive_2016_dataset.xml Access restricted to approved researchers

    2016

  7. [16]

    Franklin, Joseph E

    Daniel Crankshaw, Xin Wang, Giulio Zhou, Michael J. Franklin, Joseph E. Gonzalez, and Ion Stoica. 2017. Clipper: A Low-Latency Online Prediction Serving System. arXiv:1612.03079 [cs.DC] https: //arxiv.org/abs/1612.03079

    2017 arXiv

  8. [17]

    Mohammed Elnawawy, Assim Sagahyroon, and Tamer Shanableh. 2020. FPGA-Based Network Traffic Classification Using Machine Learning. IEEE Access (2020)

    2020

  9. [18]

    Maguire Jr., and Dejan Kostić

    Alireza Farshin, Tom Barbette, Amir Roozbeh, Gerald Q. Maguire Jr., and Dejan Kostić. 2021. PacketMill: toward per-Core 100-Gbps networking. In Proceedings of the 26th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (Virtua...

    2021

  10. [19]

    Anja Feldmann, Oliver Gasser, Franziska Lichtblau, Enric Pujol, Ingmar Poese, Christoph Dietzel, Daniel Wagner, Matthias Wichtlhuber, Juan Tapiador, Narseo Vallina-Rodriguez, Oliver Hohlfeld, and Georgios Smaragdakis. 2020. The Lockdown Effect: Implications of the COVID- 19 Pa...

    2020 doi

  11. [20]

    Craig Gutterman, Katherine Guo, Sarthak Arora, Trey Gilliland, Xi- aoyang Wang, Les Wu, Ethan Katz-Bassett, and Gil Zussman. 2020. Requet: Real-Time QoE Metric Detection for Encrypted YouTube Traf- fic. ACM Trans. Multimedia Comput. Commun. Appl.16, 2s, Article 71 (July 2020),...

    2020 doi

  12. [21]

    Jordan Holland, Paul Schmitt, Nick Feamster, and Prateek Mittal

  13. [22]

    Beomyeol Jeon, Chen Wang, Diana Arroyo, Alaa Youssef, and Indranil Gupta. 2025. A House United Within Itself: SLO-Awareness for On- Premises Containerized ML Inference Clusters via Faro. InProceedings of the Twentieth European Conference on Computer Systems (Rotterdam, Netherl...

    2025

  14. [23]

    Xi Jiang, Shinan Liu, Saloua Naama, Francesco Bronzino, Paul Schmitt, and Nick Feamster. 2023. AC-DC: Adaptive Ensemble Classification for Network Traffic Identification. arXiv:2302.11718 [cs.NI] https: //arxiv.org/abs/2302.11718

    2023 arXiv

  15. [24]

    Ansam Khraisat, Iqbal Gondal, Peter Vamplew, and Joarder Kamruzza- man. 2019. Survey of intrusion detection systems: techniques, datasets and challenges. Cybersecurity 2 (12 2019). doi:10.1186/s42400-019- 0038-7

    2019 doi

  16. [25]

    Hongyu Liu and Bo Lang. 2019. Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey.Applied Sciences 9, 20 (Jan. 2019), 4396. doi:10.3390/app9204396 Number: 20 Publisher: Multidisciplinary Digital Publishing Institute

    2019 doi

  17. [26]

    Shinan Liu, Ted Shaowang, Gerry Wan, Jeewon Chae, Jonatas Marques, Sanjay Krishnan, and Nick Feamster. 2024. ServeFlow: A Fast-Slow Model Architecture for Network Traffic Analysis. arXiv:2402.03694 [cs.NI] https://arxiv.org/abs/2402.03694

    2024 arXiv

  18. [28]

    Tarun Mangla, Emir Halepovic, Mostafa Ammar, and Ellen Zegura

  19. [29]

    Hammad Mazhar and Zubair Shafiq

    M. Hammad Mazhar and Zubair Shafiq. 2018. Real-time Video Quality of Experience Monitoring for HTTPS and QUIC. In IEEE INFOCOM Conference on Computer Communications. 14 Cruise Control : Dynamic Model Selection for ML-Based Network Traffic Analysis

    2018

  20. [30]

    Sajid Mushtaq, Brice Augustin, and Abdelhamid Mellouk

    M. Sajid Mushtaq, Brice Augustin, and Abdelhamid Mellouk. 2012. Empirical study based on machine learning approach to assess the QoS/QoE correlation. In 2012 17th European Conference on Networks and Optical Communications. 1–7. doi:10.1109/NOC.2012.6249939

    2012

  21. [31]

    Raza Ul Mustafa, Md Tariqul Islam, Christian Rothenberg, and Pe- dro Henrique Gomes. 2023. EFFECTOR: DASH QoE and QoS Eval- uation Framework For EnCrypTed videO tRaffic. In NOMS 2023- 2023 IEEE/IFIP Network Operations and Management Symposium. 1–8. doi:10.1109/NOMS56928.2023.10154448

    2023

  22. [32]

    Nguyen and Grenville Armitage

    Thuy T.T. Nguyen and Grenville Armitage. 2008. A comprehensive survey on machine learning for networking: evolution, applications and research opportunities. InIEEE Communications Surveys & Tutorials

    2008

  23. [33]

    Eva Papadogiannaki and Sotiris Ioannidis. 2021. A Survey on Encrypted Network Traffic Analysis Applications, Techniques, and Countermea- sures. ACM Comput. Surv. 54, 6, Article 123 (July 2021), 35 pages. doi:10.1145/3457904

    2021 doi

  24. [34]

    Ricardo Parizotto, Bruno Loureiro Coelho, Diego Cardoso Nunes, Israat Haque, and Alberto Schaeffer-Filho. 2023. Offloading Machine Learning to Programmable Data Planes: A Systematic Survey. ACM Comput. Surv. 56, 1, Article 18 (Aug. 2023), 34 pages. doi:10.1145/3605153

    2023 doi

  25. [35]

    Julien Piet, Dubem Nwoji, and Vern Paxson. 2023. GGFAST: Automating Generation of Flexible Network Traffic Classifiers. InProceedings of the ACM SIGCOMM 2023 Conference. 850–866

    2023

  26. [36]

    Shahbaz Rezaei, Bryce Kroencke, and Xin Liu. 2019. Large-scale Mobile App Identification Using Deep Learning. InIEEE Access

    2019

  27. [37]

    Yadwadkar, and Christos Kozyrakis

    Francisco Romero, Qian Li, Neeraja J. Yadwadkar, and Christos Kozyrakis. 2021. INFaaS: Automated Model-less Inference Serv- ing. In 2021 USENIX Annual Technical Conference (USENIX ATC 21) . USENIX Association, 397–411. https://www.usenix.org/conference/ atc21/presentation/romero

    2021

  28. [38]

    Berger, James C

    Hugo Sadok, Nirav Atre, Zhipeng Zhao, Daniel S. Berger, James C. Hoe, Aurojit Panda, Justine Sherry, and Ren Wang. 2023. Enso: A Streaming Interface for NIC-Application Communication. In 17th USENIX Symposium on Operating Systems Design and Implementa- tion (OSDI 23). USENIX A...

    2023

  29. [39]

    Mehran Salmani, Saeid Ghafouri, Alireza Sanaee, Kamran Razavi, Max Mühlhäuser, Joseph Doyle, Pooyan Jamshidi, and Mohsen Shar- ifi. 2023. Reconciling High Accuracy, Cost-Efficiency, and Low La- tency of Inference Serving Systems. In Proceedings of the 3rd Work- shop on Machine...

    2023

  30. [40]

    Tal Shapira and Yuval Shavitt. 2021. FlowPic: A Generic Representation for Encrypted Traffic Classification and Applications Identification. In IEEE Transactions on Network and Service Management

    2021

  31. [41]

    Taveesh Sharma, Tarun Mangla, Arpit Gupta, Junchen Jiang, and Nick Feamster. 2023. Estimating WebRTC Video QoE Metrics Without Us- ing Application Headers. In ACM SIGCOMM Internet Measurement Conference (IMC). Montreal, Canada, 1–12

    2023

  32. [42]

    Meng Shen, Ke Ye, Xingtong Liu, Liehuang Zhu, Jiawen Kang, Shui Yu, Qi Li, and Ke Xu. 2023. Machine Learning-Powered Encrypted Network Traffic Analysis: A Comprehensive Survey. IEEE Communications Surveys & Tutorials 25, 1 (2023), 791–824. doi:10.1109/COMST.2022. 3208196

    2023 doi

  33. [43]

    Jayveer Singh and Manisha Nene. 2013. A survey on machine learning techniques for intrusion detection systems. InInternational Journal of Advanced Research in Computer and Communication Engineering

    2013

  34. [44]

    Julio Costella Vicenzi, Guilherme Korol, Michael Guilherme Jordan, Mateus Beck Rutzig, and Antonio Carlos Schneider Beck Filho. 2023. Adaptive Inference on Reconfigurable SmartNICs for Traffic Classifi- cation. In Advanced Information Networking and Applications

    2023

  35. [45]

    Gerry Wan, Fengchen Gong, Tom Barbette, and Zakir Durumeric. 2022. Retina: Analyzing 100GbE Traffic on Commodity Hardware. InProceed- ings of the ACM SIGCOMM 2022 Conference (Amsterdam, Netherlands) (SIGCOMM ’22). Association for Computing Machinery, New York, NY, USA, 530–544...

    2022

  36. [46]

    Gerry Wan, Shinan Liu, Francesco Bronzino, Nick Feamster, and Za- kir Durumeric. 2025. CATO: End-to-End Optimization of ML-Based Traffic Analysis Pipelines. In22nd USENIX Symposium on Networked Systems Design and Implementation (NSDI 25) . USENIX Association, Philadelphia, PA,...

    2025

  37. [47]

    Xiaoban Wu, Peilong Li, Yongyi Ran, and Yan Luo. 2018. Network measurement for 100 GbE network links using multicore processors. Future Gener. Comput. Syst. 79, P1 (feb 2018), 180–189. doi:10.1016/j. future.2017.04.038

    2018 doi

  38. [48]

    Zhaoqi Xiong and Noa Zilberman. 2019. Do Switches Dream of Machine Learning? Toward In-Network Classification. InProceedings of the 18th ACM Workshop on Hot Topics in Networks(Princeton, NJ, USA)(HotNets ’19). Association for Computing Machinery, New York, NY, USA, 25–33. doi:...

    2019

  39. [49]

    Amac Guvensan, A

    Baris Yamansavascilar, M. Amac Guvensan, A. Gokhan Yavuz, and M. E. Karsligil. 2017. Application identification via network traffic classifica- tion. In 2017 International Conference on Computing, Networking and Communications (ICNC). 843–848. doi:10.1109/ICCNC.2017.7876241

    2017

  40. [50]

    Jeff (Jun) Zhang, Sameh Elnikety, Shuayb Zarar, Atul Gupta, and Siddharth Garg. 2020. Model-switching: dealing with fluctuating workloads in machine-learning-as-a-service systems. InProceedings of the 12th USENIX Conference on Hot Topics in Cloud Computing (Hot- Cloud’20). USE...

    2020

  41. [51]

    Hoe, Vyas Sekar, and Justine Sherry

    Zhipeng Zhao, Hugo Sadok, Nirav Atre, James C. Hoe, Vyas Sekar, and Justine Sherry. 2020. Achieving 100Gbps Intrusion Prevention on a Single Server. In14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20). USENIX Association, 1083–1100. https: //www.us...

    2020

  42. [52]

    Jiuxing Zhou, Wei Fu, Wei Hu, Zhihong Sun, Tao He, and Zhihong Zhang. 2024. Challenges and Advances in Analyzing TLS 1.3-Encrypted Traffic: A Comprehensive Survey.Electronics 13, 20 (2024). doi:10.3390/ electronics13204000 15

    2024

  43. [2018]

    In2018 Network Traffic Measurement and Analysis Con- ference (TMA)

    emimic: Estimating http-based video qoe metrics from encrypted network traffic. In2018 Network Traffic Measurement and Analysis Con- ference (TMA). IEEE, 1–8

  44. [2019]

    IEEE Transactions on Network and Service Management 16, 3 (2019), 1086–1099

    Using session modeling to estimate HTTP-based video QoE metrics from encrypted network traffic. IEEE Transactions on Network and Service Management 16, 3 (2019), 1086–1099

    2019

  45. [2021]

    In Proceed- ings of the 2021 ACM SIGSAC Conference on Computer and Commu- nications Security (Virtual Event, Republic of Korea)(CCS ’21)

    New Directions in Automated Traffic Analysis. In Proceed- ings of the 2021 ACM SIGSAC Conference on Computer and Commu- nications Security (Virtual Event, Republic of Korea)(CCS ’21). Asso- ciation for Computing Machinery, New York, NY, USA, 3366–3383. doi:10.1145/3460120.3484758

    2021

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.