Encrypted Traffic Classification

Latest papers

15 papers3 papers in the last four weeks, against 2 the four weeks before. 0.0% of all new papers.

Unknown-Traffic Detection, Calibration and Shortcut Reliance in Distilled Encrypted-Traffic Classifiers over One Year
Sep 25, 2026Mahmoud AbbasiEncrypted Traffic Classification Knowledge Distillation
University of Salamanca, Salamanca, Spain · AIR Institute, Salamanca, Spain
FlowAtom: Atom-Based Evidence Aggregation for Multi-Label Website Fingerprinting
Sep 24, 2026Chongru Fan, Wentao Huang, Wei Wang +4Multi-Label Classification Prototype Learning
School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China · Zhongguancun Laboratory, Beijing, China
Multi-View Fusion for Encrypted C2 Detection: A Leakage-Controlled Measurement Study of Evaluation Pitfalls
Sep 23, 2026Hoang-Huy Nguyen-Huu, Van-Tri Phan, Khuong Nguyen-AnEncrypted Network Traffic Analysis Encrypted Traffic Classification
Academy of Cryptography Techniques, Ho Chi Minh City Campus, Vietnam · Faculty of Computer Science and Engineering, Ho Chi Minh City University of Technology (HCMUT), 268 Ly Thuong Kiet Street, Dien Hong Ward, Ho Chi Minh City, Vietnam · Vietnam National University Ho Chi Minh City, Linh Xuan Ward, Ho Chi Minh City, Vietnam
SoK: Where Do Flow Labels Come From? Auditing Label Provenance in Encrypted Traffic Benchmarks
Sep 2, 2026Sizhe Huang, Shujie YangEncrypted Traffic Classification Benchmark Auditing
arXiv:2609.02140v1
TDDM-Melatt: A Decoupled Memory and Diffusion Framework for Generalizable Encrypted Traffic Classification
Aug 31, 2026Ze Chen, Qiming Yu, Zijia Song +2Memory-Augmented Neural Networks Disentangled Representation Learning
National University of Defense Technology Hefei, Anhui, China
Pruned Traffic Trees: Native Semantic Compression with a Protocol-Structured Model Family for Encrypted Traffic Classification
Aug 22, 2026Yuantu Luo, Jun Tao, Xiangyu Xu +2Encrypted Traffic Classification Encrypted Network Traffic Analysis
School of Cyber Science and Engineering, Southeast University, Nanjing, China · School of Computer Science and Engineering, Southeast University, Nanjing, China
PERO: Efficient Robust Post-Training Foundation Models for Encrypted Traffic Classification
Aug 16, 2026Wumei Du, Jiarong Wen, Kaiyu Zhang +5Encrypted Traffic Classification Encrypted Network Traffic Analysis
National University of Defense Technology, Changsha, China
Traffic-CBM: A Structurally Interpretable Multimodal Framework for Encrypted Traffic Classification
Jun 29, 2026Honglei Jin, Wenshuo Chen, Shaofeng Liang +6Encrypted Network Traffic Analysis Multimodal Classification
HKUST (GZ) Guangzhou, China · Shandong University Qingdao, China
GETA: Generalized Encrypted Traffic Analysis
May 29, 2026Ransika Gunasekara, Rahat Masood, Salil KanhereDomain Adaptation Network Intrusion Detection
University of New South Wales (UNSW)
MambaNetBurst: Direct Byte-level Network Traffic Classification without Tokenization or Pretraining
May 11, 2026Gayan K. Kulatilleke, Siamak Layeghy, Mahsa Baktashmotlagh +1Network Intrusion Detection Encrypted Traffic Classification
University of Queensland, Brisbane, Australia
Multimodal Reasoning with LLM for Encrypted Traffic Interpretation: A Benchmark
Apr 9, 2026Longgang Zhang, Xiaowei Fu, Fuxiang Huang +1Encrypted Network Traffic Analysis Encrypted Traffic Classification
School of Microelectronics and Communication Engineering, Chongqing University, Chongqing 400044, China. · School of Data Science, Lingnan University, Hong Kong, China.
Mean Masked Autoencoder with Flow-Mixing for Encrypted Traffic Classification
Mar 31, 2026Xiao Liu, Xiaowei Fu, Fuxiang Huang +1Encrypted Traffic Classification Encrypted Network Traffic Analysis
School of Microelectronics and Communication Engineering, Chongqing University, Chongqing 400044, China · School of Data Science, Lingnan University, Hong Kong, China
TrafficMoE: Heterogeneity-aware Mixture of Experts for Encrypted Traffic Classification
Mar 31, 2026Qing He, Xiaowei Fu, Lei ZhangEncrypted Traffic Classification Encrypted Network Traffic Analysis
School of Microelectronics and Communication Engineering, Chongqing University, Chongqing 400044, China.
Where Do Flow Semantics Reside? A Protocol-Native Tabular Pretraining Paradigm for Encrypted Traffic Classification
Mar 9, 2026Sizhe Huang, Zitong Li, Shujie YangEncrypted Traffic Classification Encrypted Network Traffic Analysis
State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing, China.
PACC: Protocol-Aware Cross-Layer Compression for Compact Network Traffic Representation
Feb 9, 2026Zhaochen Guo, Honghao Wang, Tianyufei Zhou +2Representation Learning Encrypted Network Traffic Analysis
University of Electronic Science and Technology of China Chengdu, Sichuan, China · Renmin University of China Beijing, China · University of Hong Kong Hong Kong, China +1

Sep 25, 2026J/K move · Enter open · S save

Unknown-Traffic Detection, Calibration and Shortcut Reliance in Distilled Encrypted-Traffic Classifiers over One Year

Mahmoud Abbasi

University of Salamanca, Salamanca, Spain · AIR Institute, Salamanca, Spain

Encrypted Traffic Classification Knowledge Distillation Encrypted Network Traffic Analysis OOD Detection Model Calibration Shortcut Learning

Open paper AskPDF arXiv

Knowledge distillation is the standard way to compress encrypted-traffic classifiers for the edge, and almost all such work judges students by accuracy alone. We ask what else a student inherits: unknown-traffic detection, calibration, shortcut reliance, and whether any survives a year of drift. Resemblance proves little on its own, since soft targets also regularise. We therefore distil one 101k-parameter student from two teachers of equal accuracy but different construction, a five-member ensemble and a single wider model, so that following one rather than the other is attributable to it. The design was pre-registered before any test result was seen. We tested ten hypotheses on CESNET-TLS-Year22, a year of real TLS traffic, across 18 test windows over 35 weeks. Two are supported: a student's per-flow unknown-scores shift toward its own teacher, but only at a conventional temperature, not the accuracy-optimal one; and a shortcut-reliant teacher passes its over-confidence to a student that never sees the feature. The drift prediction is reversed under both scores, the gap narrowing rather than widening and the student overtaking under the energy score in two of three replicates, as is the prediction that such a teacher harms its student's detection, which improves slightly. Shortcut reliance is set by model size, not distillation. Under the logit-based scores nothing else transfers: distillation beats neither a temperature-scaled direct student nor label smoothing. Exploratory analysis shows this turns on the scoring rule: with a feature-space detector the teacher detects unknown traffic 0.073 AUROC better than the direct student, where the energy score sees 0.000, and the conventional-temperature student inherits most of it. Label smoothing, with no teacher, recovers more. Distillation transfers the teacher's habits; what looks like an inherited ability is available without one.