From Ethernet to Wi-Fi: Flow Feature Selection and Construction for Traffic Classification

Francisco Rau; Petia Georgieva; Carlos Herranz; Iñaki Val; Joaquin Perez

cs.NIOct 27, 2026

From Ethernet to Wi-Fi: Flow Feature Selection and Construction for Traffic Classification

Authors: Francisco Rau, Petia Georgieva, Carlos Herranz, Iñaki Val, Joaquin Perez

Organizations: MaxLinear, Inc., Valencia, Spain · Electronic Engineering Department, Universitat de València, Valencia, Spain · Institute of Electronics and Informatics Eng. of Aveiro (IEETA), University of Aveiro, Portugal

Abstract

Flow-based traffic classifiers trained on Ethernet data may lose accuracy when applied to Wi-Fi traffic. This paper proposes a five-stage procedure for selecting and constructing features that enable Wi-Fi flow classification using models trained only on Ethernet data. The procedure removes the transport protocol identifier, examines rate dependence, compares feature distributions and the information each feature provides for the application classes, reduces redundancy, and constructs normalized packet-size and temporal features. Ethernet and Wi-Fi traffic are simulated in ns-3, with Wi-Fi using Best Effort access category. Labelled Wi-Fi data from six development scenarios are used for feature design, while a separate scenario is reserved for final testing. The evaluation compares feature sets, examines threshold sensitivity, and analyses classification errors under different traffic conditions.

Figures & tables

ID	Application (classes)	(Mb/s)	Train	Test	S1–S6	S7
		Rate for training	Ethernet		Wi-Fi
VP	VoIP	0.10	216	69	1,620	270
VC	Video Conference	3	216	69	2,160	270
GM	Gaming (Quake 3)	0.11	216	69	1,890	270
VS	Video Streaming (DASH)	20	216	69	1,876	540
BT	Bulk TCP	10	216	69	742	270

TABLE I: Common application classes and dataset windows.

Fig. 1: Distribution shift and class information for 16 features. Blue: retained; red: removed. Dashed lines show the KS threshold (0.30) and MI-ratio thresholds (0.60 and 1.00). Shaded areas show removal regions.

Original	Constructed	$s_{\mathrm{orig}}$	$s_{\mathrm{constr}}$
std_pkt_size	min_max_ratio	0.673	0.027
burstiness	pkt_size_range_r	0.667	0.493
max_iat	activation_fraction	0.803	0.803
min_iat	iat_min_ratio	0.803	0.766

TABLE II: Rate-dependence scores before and after feature construction (

s(X)

from Section II-B2 ).

Feature	Formula
rms_pkt_size	$\sqrt{\overline{s^{2}}}$
max_pkt_size	$s_{\max}$
switching_ratio	$n_{\Delta s}/(N-1)$
min_max_ratio	$s_{\min}/s_{\max}$
pkt_size_range_r	$(s_{\max}-s_{\min})/\bar{s}$
activation_fraction	$1-\tau_{\max}/T$

TABLE III: Final seven dimensional feature space.

Scenario	Network	VP	VC	GM	VS	BT	IT	IU	BU	Flows	Windows
S1	One BSS	0.10	5, 10	0.11, 0.11	20	15	–	200, 200	100	10	2,699
S2	One BSS	0.10	5, 10	0.11	20	15	unb.	200, 200	100	10	2,691
S3	Two BSSs *	0.10	5	0.11	20	–	–	–	–	4	1,080
S4	Two BSSs *	0.10	5	0.11	20, 10	–	–	–	–	5	1,350
S5	Two BSSs *	0.10	5	0.11	20	–	–	–	300	5	1,346
S6	Two BSSs *	0.10	5	0.11	20	15	–	–	300	6	1,552

TABLE IV: Wi-Fi scenarios: downlink flow rates (Mb/s) by application ID from Table I .

Fig. 2: Accuracy after each feature selection and construction stage (Section II-B ; Ratios: feature construction) on the four evaluation sets of Section III-C . Ethernet training accuracy is 100% at every stage. Where the two Wi-Fi lines overlap, the upper value is S7 and the lower value is S1–S6.

	S1–S6		S7
Class	29	7	29	7
Bulk TCP	63.1	98.2	0.0	100
IPERF TCP	93.0	38.9	99.3	99.3
Video Streaming	49.8	99.7	98.3	100
Other five classes	100	100	100	100
Accuracy	88.48	98.28	$88.44\pm 0.27$	$99.92\pm 0.18$

TABLE V: Recall (%) per class, accuracy, Macro-F1 with 29 and 7 features.

	S2	S7
Downlink load requested by the other flows (Mb/s)	$\approx$ 550	$\approx$ 120
IPERF TCP throughput (Mb/s)	12	197
Mean downlink delay of IPERF TCP at the AP (ms)	147	8
IPERF TCP windows with activation_fraction $<0.98$	63%	0.7%
Median activation_fraction of Video Streaming	0.97	0.72
IPERF TCP recall (%)	38.9	99.3

TABLE VI: Traffic conditions in S2 and S7, and IPERF TCP recall with seven features.

Feature Selection

Feature selection identifies compact, informative variables or input dimensions to improve prediction, efficiency, interpretability, and statistical inference.

See all 200 papers

A First Glance at Jev for Network Traffic Classification: Accuracy, Processing Time, and Cost
Sep 30, 2026Shenghe Xu, Lifan MeiCybersecurity Few-Shot Learning
Amazon.com, Inc. · Xi’an Jiaotong-Liverpool University
FlowWise: Stateful Fast-Slow Model Serving for Streaming Traffic Intelligence
Feb 6, 2024Shinan Liu, Ted Shaowang, Gerry Wan +4Cascaded Inference Efficient Neural Network Inference
University of Chicago, Chicago, IL, USA · Stanford University, Stanford, CA, USA
Pruned Traffic Trees: Native Semantic Compression with a Protocol-Structured Model Family for Encrypted Traffic Classification
Aug 22, 2026Yuantu Luo, Jun Tao, Xiangyu Xu +2Encrypted Traffic Classification Encrypted Network Traffic Analysis
School of Cyber Science and Engineering, Southeast University, Nanjing, China · School of Computer Science and Engineering, Southeast University, Nanjing, China

Sep 30, 2026J/K move · Enter open · S save

A First Glance at Jev for Network Traffic Classification: Accuracy, Processing Time, and Cost

Shenghe Xu, Lifan Mei

Amazon.com, Inc. · Xi’an Jiaotong-Liverpool University

Cybersecurity Few-Shot Learning Classification

Open paper AskPDF arXiv

We evaluate Jev on ten dataset-defined application labels in CESNET-QUICEXT-25 using only the first ten packets' sizes, directions, and inter-packet times. To the best of our knowledge, this is the first empirical study of general-purpose decision models, represented here by Jev, for application classification of network flows. Across 52,000 records from 26 collection weeks following the training period, 40 fixed labeled examples raise Jev's accuracy from 9.80% to 28.42%. Random Forest and Extra Trees trained on 8,000 records achieve 69.95% and 66.80% and outperform Jev in every week. Increasing Jev's context to 150 examples yields 34.50% on the first test week. On a paired 100-record subset, Jev with 40 examples achieves 29% accuracy at a median request time of 0.750 s, versus 37% and 6.036 s for the generative language model OpenAI GPT-5.6 Sol with high reasoning effort through Azure; Jev also incurs lower API charges. The paired subset does not establish an accuracy advantage for either service, and the timing reflects different service configurations. Thus, labeled examples substantially improve Jev, but the tested Jev configurations remain less accurate than trained tree ensembles; unequal supervision budgets and fixed configurations prevent attributing the gap to a single cause.

Abstract

Feature Selection

Explore similar work

A First Glance at Jev for Network Traffic Classification: Accuracy, Processing Time, and Cost

FlowWise: Stateful Fast-Slow Model Serving for Streaming Traffic Intelligence

Pruned Traffic Trees: Native Semantic Compression with a Protocol-Structured Model Family for Encrypted Traffic Classification