Agentic Network Traffic Monitoring

Manuel Tsoukatos; Hayden Jananthan; Jeremy Kepner

cs.AISep 26, 2026

Agentic Network Traffic Monitoring

Authors: Manuel Tsoukatos, Hayden Jananthan, Jeremy Kepner

Organizations: United States Air Force · Massachusetts Institute of Technology

Abstract

As the use of agentic artificial intelligence increases in nearly every industry, there exists a widening attack surface. It is necessary to monitor agents to ensure that agents are acting in a way that is aligned with the users intent. Auditing an agent's network traffic provides a clear record of the agent interactions. This work presents a novel approach to monitoring the network traffic of agentic systems using complex valued hypersparse traffic matrices by integrating DBOS (DataBase OS), the OneSparse PostgreSQL database, and the GraphBLAS math library. To develop these concepts an agentic simulator was constructed, allowing a varying numbers of AI agents to collectively survey a virtual environment using different strategies. The resulting network traffic matrices enable easy monitoring of the AI agents.

Figures & tables

Fig. 1: Information flow diagram

Fig. 2: Communication protocol diagram

Fig. 3: The above displays the key aspects of each simulation. The rows are individual simulations, showcasing the baseline, daisy chain, hierarchical, and low-range daisy chain scenarios. The columns are the two maps (ground truth and mental map), and two traffic matrices (true source/destination pairs and all intermediary communication hops). The maps and everything besides the communication protocols were kept the same to compare the resulting traffic matrices.

AI Agent Monitoring

AI agent monitoring tracks actions, tool use, and execution traces to detect failures, misuse, drift, and policy violations during operation.

See all 285 papers

ANT: A Multi-Granularity Network Traffic Dataset and Benchmark for Agents Behavior Auditing
Oct 5, 2026Fan Li, Xiangyu Gao, Zixuan Liu +4AI Agent Auditing AI Agent Security Benchmarks
Tsinghua University, Beijing, China · Zhongguancun Laboratory, Beijing, China · Renmin University of China, Beijing, China +1
AI Snitches Get Glitches: Towards Evading Agentic Surveillance
Jun 24, 2026Hyejun Jeong, Dzung Pham, Amir Houmansadr +1AI Agent Security AI Agent Security Benchmarks
University of Massachusetts Amherst
One Monitor Does Not Fit All: Formalism-Agnostic Runtime Verification for Agentic AI
Oct 14, 2026Angelo FerrandoAI Agent Monitoring Runtime Enforcement for AI Agents
University of Modena and Reggio Emilia, Modena, Italy

Oct 5, 2026J/K move · Enter open · S save

ANT: A Multi-Granularity Network Traffic Dataset and Benchmark for Agents Behavior Auditing

Fan Li, Xiangyu Gao, Zixuan Liu, Tong Li+3

Tsinghua University, Beijing, China · Zhongguancun Laboratory, Beijing, China · Renmin University of China, Beijing, China+1

AI Agent Auditing AI Agent Security Benchmarks LLM Agents

Open paper AskPDF arXiv

The growing adoption of large language model (LLM) agents creates a need for network administrators and security teams to audit agent behavior within organizational networks without inspecting private user content. Network traffic offers an observable source of evidence, but how much it reveals about agent tasks and operations remains unclear. Existing traffic datasets lack the joint task and stage annotations needed to evaluate this question. We introduce ANT (Agent Network Traffic), a dataset providing agent behavior information at risk, scenario, and behavior primitive granularities alongside network traffic. ANT contains 3,114 execution episodes across 20 tasks and five scenarios, comprising 276,417 bidirectional flows and 40,049 behavior primitive segments organized into 47 macro groups. We establish a benchmark for agent risk identification, scenario recognition, and behavior primitive classification using 13 representative traffic analysis baselines. The results show that existing methods recover useful but uneven behavioral signals. They struggle to identify risk when malicious workflows resemble benign tasks and to distinguish scenarios with similar traffic patterns. Primitive classification is more reliable for frequent macro groups and those with distinctive traffic patterns than for rare or semantically similar groups. ANT provides a common basis for developing more precise auditing and forensic analysis of agent behavior from network traffic. Our data and code are available at https://anonymous.4open.science/r/ant-main-suite-7BC0/.

Abstract

AI Agent Monitoring

Explore similar work

ANT: A Multi-Granularity Network Traffic Dataset and Benchmark for Agents Behavior Auditing

AI Snitches Get Glitches: Towards Evading Agentic Surveillance

One Monitor Does Not Fit All: Formalism-Agnostic Runtime Verification for Agentic AI