Pith. sign in

REVIEW 4 major objections 5 minor 52 references

FlowletFormer: Network Behavioral Semantic Aware Pre-training Model for Traffic Classification

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Timing-based 'flowlets' power a traffic BERT that wins 7 of 8 benchmarks

desk verdict Genuine design improvements for traffic pre-training, but single-run comparisons and a copy-paste ablation error make the SOTA claim premature. read the letter →

arxiv 2508.19924 v1 pith:ZIY5EFPK submitted 2025-08-27 cs.LG

Liming Liu , Ruoyu Li , Qing Li , Meijia Hou , Yong Jiang , Mingwei Xu This is my paper
classification cs.LG
keywords trafficclassificationpre-trainingBERTflowletfieldtokenizationprotocolsemanticsfew-shotlearningencrypted
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the way network traffic is chopped into tokens is the main bottleneck for transformer-based traffic classification. It proposes FlowletFormer, which segments flows into 'flowlets'—bursts of packets separated by pauses in arrival time—and tokenizes each packet by protocol header field rather than by arbitrary hex bigrams. A protocol-layer embedding tells the model whether a token comes from the IP, transport, or application layer, and two pretraining objectives (masking key header fields and predicting flowlet order and relatedness) teach it both packet-level and flow-level behavior. On eight fine-tuning datasets, the model beats state-of-the-art baselines on seven, with F1 gains over 5 points on five; it also retains more accuracy than baselines when only 10-40% of labels are available. If this holds, pretraining on unlabeled traffic could substantially cut the labeled data needed for network monitoring and security tasks.

What carries the argument

The core object is the Flowlet: a flow segment whose boundary is set by an adaptive inter-arrival-time (IAT) threshold, computed as the running mean of past IATs; a new flowlet starts when the current IAT exceeds that threshold. Around it sit three supporting mechanisms: Field Tokenization, which converts each packet into hexadecimal tokens aligned with protocol header field boundaries (vocabulary 65,812 tokens); a Protocol Stack Alignment-Based Embedding Layer, which adds a learned embedding for the network/transport/application layer of each token; and the two pretraining objectives—Masked Field Model, which biases masking toward semantically critical fields (IP version, ports, TCP flags,

What would settle it

Run the same fine-tuning protocol with 5-10 random seeds per dataset and report mean plus/minus standard deviation of F1. If FlowletFormer's margin over the best baseline falls below the seed standard deviation on more than one or two datasets, the claimed state-of-the-art advantage is not reliably distinct from noise. A cheaper check: count how often FlowletFormer beats TrafficFormer across the five malware splits reported in Table 11—the paper reports 3 of 5.

Watch

Extended reading notes

Core claim

FlowletFormer claims that transformer pretraining for traffic classification should operate on flowlets—semantically coherent groups of packets separated by inter-arrival-time gaps—instead of on NLP-style bursts or subword-tokenized hex strings. The model tokenizes each packet by protocol header fields, adds a protocol-stack alignment embedding so the transformer can distinguish IP-layer tokens from TCP-layer tokens from application payload, and pretrains with a Masked Field Model plus a Flowlet Prediction Task. The central empirical claim is that this combination achieves state-of-the-art F1 on 7 of 8 public fine-tuning datasets—including service identification, Tor classification, website

Load-bearing premise

The headline result assumes the F1 gaps in Tables 2 and 3 are larger than run-to-run and split-to-split noise; the paper's own five-seed check on the malware dataset shows a 1% gap flipping direction, and most reported numbers come from a single run.

Editorial extensions

If this is right

  • Traffic classifiers could be pretrained once on large unlabeled packet captures and then fine-tuned for services, malware, intrusion detection, or IoT tasks using far fewer labeled samples.
  • The model's performance on field-understanding tasks—inferring flow direction, transport protocol, TCP sequence order, and connection-control flags—suggests it learns protocol state-machine semantics, not just surface patterns.
  • The flowlet prediction objective captures behavioral phases such as request, download, and disconnect, which could transfer to sequence-level analyses beyond classification, like anomaly detection or session-state reconstruction.
  • Because fine-tuning anonymizes IP addresses and ports, the reported results indicate the model does not rely on raw addresses, making it more likely to generalize across network environments and to respect privacy constraints.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The flowlet segmentation threshold is a simple running mean of inter-arrival times; an obvious extension the paper does not test is whether change-point detection or per-protocol thresholds would produce even more behaviorally coherent units, and whether that would further improve classification.
  • The malware-dataset check in the paper itself (Table 11) shows that a 1% F1 gap flips across random splits, so while FlowletFormer's direction of improvement is plausible, the exact margins on several of the 7 datasets likely contain seed-to-seed noise and should be read as approximate.
  • The port-analogy probing could be extended to other service families (SSH, DNS, email) and to a direct comparison of whether the model learns port-number semantics or merely co-occurrence with the applications that use those ports.
  • If flowlets really correspond to logical interactions, the same pretraining recipe could transfer to encrypted-traffic tasks beyond classification, such as early connection-state inference or per-connection behavioral fingerprinting.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes FlowletFormer, a BERT-base pre-training model for network traffic classification. The method introduces three components: (i) a flowlet-based traffic representation with field-level tokenization that segments flows into behaviorally coherent units; (ii) a protocol-stack alignment embedding that encodes the network/transport/application layer of each token; and (iii) two pre-training objectives, a Masked Field Model and a Flowlet Prediction Task, designed to capture field-level semantics and inter-flowlet relationships. The authors evaluate the model on 8 public fine-tuning datasets and report state-of-the-art performance on 7 of them, with claimed F1 improvements of over 5% on 5 datasets. They also present probing experiments (field understanding tasks and port analogy similarity) and few-shot analyses to support the claim that the pre-trained model learns meaningful traffic behavior.

Significance. If the empirical claims hold, FlowletFormer would be a useful contribution to traffic classification. The flowlet segmentation and field tokenization are domain-motivated alternatives to the burst/BPE representations used by prior pre-training models, and the dual pre-training objectives are plausible mechanisms for learning both intra-packet and inter-packet structure. The paper makes a genuine attempt to go beyond accuracy numbers by probing protocol-field understanding and analogy structure, and the code is promised in the supplementary material. However, the central claim of state-of-the-art performance currently rests on a weak empirical foundation: single-run evaluations without variance or significance testing, and several small margins that the paper's own seed study shows are within split-to-split noise. The ablation tables also contain numerically duplicated rows across datasets, which reduces confidence in the supporting evidence. The idea is promising and the limitations seem fixable, but the evidence as presented is not yet sufficient for the strength of the claims.

major comments (4)
  1. [Comparison with State-of-the-Art Methods (Tables 2-3, Appendix Table 11)] The headline claim of state-of-the-art performance on 7 of 8 datasets is supported only by single-run metrics. Several margins in Tables 2 and 3 are small: CIC-IDS2017 F1 0.9079 vs 0.8959 (+1.2), Browser 0.6684 vs 0.6410 (+2.7), CSTNET-TLS 0.8473 vs 0.8140 (+3.3), ISCX-VPN(App) 0.7712 vs 0.7254 (+4.6). The paper's own robustness study in Appendix Table 11 shows that on USTC-TFC, a difference of about 1 point is not stable: across 5 seeds FlowletFormer wins 3 and loses 2, with one loss of nearly 3 points (0.9900 vs 0.9615). This directly demonstrates that margins of this size are within data-split noise. To support the claim of 'significant outperformance', the authors should report mean and standard deviation over multiple seeds/splits for all datasets, or at minimum report significance tests for the datasets with margins below 5 points.
  2. [Appendix E, Ablation Tables 12 and 13] Ablation results contain duplicated numerical rows across different datasets. The 'w/o MFM' row for ISCX-Tor2016 in Table 12 (0.4505/0.1790/0.3300/0.2304) is identical to the 'w/o MFM' row for CIC-IDS2017 in Table 13. The same duplication occurs for 'w/o FPT', 'w/o PE', and 'w/o PT' rows between these two tables. These rows cannot be correct for both datasets. This is not merely a typographical issue: the ablation study is used to attribute performance to specific components (FL, MFM, FPT, PE, PT), and duplicated values undermine the validity of those attributions. The authors must regenerate the correct ablation tables and verify that each row corresponds to the intended dataset.
  3. [Introduction and Section 4.2 (claimed 'over 5% F1 improvement on 5 datasets')] The claim of 'over 5% F1 improvement on 5 datasets' is ambiguous and, under the most natural reading, inaccurate. Comparing FlowletFormer against the strongest baseline in Tables 2 and 3, only ISCX-Tor2016 (+16.6 points) and CIC-IoT2022 (+5.7 points) improve by more than 5 points; other margins are 1.2, 2.7, 3.3, and 4.6 points. The 5-dataset figure appears to be relative to the best non-pretraining baseline rather than the strongest overall competitor. The text should state explicitly which baseline is used for the comparison, or revise the claimed improvement to match the actual margins against the best reported method.
  4. [Section 4.5, Field Understanding Tasks (Table 4)] The field understanding probing tasks are reported as single-run accuracies without error bars or statistical significance. Since these tasks are used to support the claim of superior protocol understanding, and some task accuracies in Table 4 differ by large margins (e.g., Flow Direction Inference), a multi-seed evaluation would substantially strengthen the claim. With the current single-run reporting, it is possible that some differences are due to random initialization or data sampling.
minor comments (5)
  1. [Equation 2] The notation 'mi' and 'm_hat_i' is not defined; presumably mi is a one-hot label. Please define these terms.
  2. [Table 5] The column labels 'Embedding' and 'Word Input' / 'Input Embedding' are confusing. Clarify what is meant by 'Word Embedding' versus 'Input Embedding' in the port analogy analysis.
  3. [Table 1 and Table 8] Tables 1 and 8 list the same key protocol fields. One of the tables should be removed or the duplication should be acknowledged.
  4. [Appendix D, Implementation] The implementation mentions use of the UER toolkit (Zhao et al. 2019), but that reference is not included in the bibliography. Please add it.
  5. [Figure 3] The figure axes and legend labels are not fully legible in the provided version. Please ensure all subplots have clear axis labels and a shared legend.

Circularity Check

1 steps flagged · score 4.0 of 10

Held-out classification SOTA is not circular; the 'field understanding' probes, however, re-execute the Masked Field Model's own training objective and are therefore partial circular evidence for the comprehension claim.

  1. fitted input called prediction [Section 4.5 (Field Understanding Task, Table 4) vs Section 3.3 (Masked Field Model) and Table 1/8]
    "We introduce multiple Field Understanding Tasks to assess whether the pre-trained model comprehends general traffic patterns. These tasks require the model to predict key header fields within a packet in a given flow. During pre-training, 15% of the tokens in the input sequence are masked. Half of these masked tokens are randomly selected from the key field tokens mentioned in Table 8."

    The four probes (Flow Direction: source/destination IP and ports; Transport Protocol: IP protocol field; Sequence Awareness: TCP seq/ack; Connection Control: TCP flags) are exactly the 'key fields' that the Masked Field Model pre-training loss (L_MFM) trains the model to predict (Table 1/8 lists IP Address, Port Number, Protocol, Sequence Number, Acknowledgment Number, Flag). The probe therefore re-tests the training objective itself: high zero-shot accuracy is by construction a measure of how well the fitted objective was learned, not independent evidence of 'comprehension of the principles of network transmission.' The held-out classification comparisons are unaffected, but the understanding claim is partially circular.

full rationale

The central classification claim (SOTA on 7/8 public datasets) is evaluated on fine-tuning datasets with held-out labels and is not derived from the model's own pre-training objective, so it is not circular. The paper is not built on a self-citation chain; baselines are external and the design choices (flowlet segmentation, protocol embedding, MFM/FPT) are evaluated by ablation on downstream tasks. The one circular element is the Field Understanding Task: it is defined as masked prediction of the same protocol header fields that the Masked Field Model was explicitly pre-trained to predict, so it cannot independently establish 'understanding' or 'comprehension.' This is a secondary, non-central claim; it does not reduce the main classification results. Statistical weaknesses (single-run comparisons, no error bars on the headline numbers, duplicated ablation rows) are correctness/robustness concerns rather than circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

No new physical or theoretical entities are introduced. The flowlet is a segmentation construct known in networking, and the embedding layer is a model component, not a postulated entity. The free parameters listed are hand-chosen constants in the evaluation pipeline that affect the measured results.

free parameters (3)
  • Input representation constants = 64 bytes from network layer; first 5 packets; 512 tokens
    Chosen by hand for all experiments; the model only sees this truncated view, so classification gains may not generalize to full-packet or long-flow tasks.
  • Masking hyperparameters = 15% masked, 80/10/10 replacement
    Adopted from BERT without tuning for traffic; the 50% key-field sampling ratio is a design choice that affects the Masked Field Model objective.
  • Flowlet initial threshold condition = i > 3 and theta_3 = mean of first two IATs
    Heuristic in Algorithm 1; if flowlets are mis-segmented for flows with fewer than 4 packets or irregular timing, the behavioral-unit claim weakens.
assumptions (4)
  • ad hoc to paper Protocol header fields are atomic semantic units and should not be split by subword tokenization.
    Stated in Field Tokenization section as the core motivation; if false (e.g., if field-value distributions benefit from subword sharing), the tokenizer design would be suboptimal.
  • domain assumption The IAT-based flowlet boundary correlates with logical interaction phases (request, response, disconnect) across diverse protocols.
    Invoked in Flowlet Generation and Flowlet Prediction Task; the entire behavioral-unit notion depends on this correlation.
  • domain assumption Pre-training on 30GB from ISCX-VPN, CIC-IDS2017-Monday, and WIDE transfers to all 8 fine-tuning datasets.
    Experiment Setup states this without analysis of distribution shift; if transfer fails, the fine-tuning results would not support the pre-training claims.
  • domain assumption The BERT-Base architecture and Adam/AdamW optimization are suitable for this traffic tokenization.
    The paper reuses the off-the-shelf architecture without modification; this is a standard assumption in pre-training papers.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FlowletFormer: Network Behavioral Semantic Aware Pre-training Model for Traffic Classification." pith.science (2026). https://pith.science/paper/ZIY5EFPK

@misc{pith2026250819924,
  author       = {Pith},
  title        = {Pith review of: FlowletFormer: Network Behavioral Semantic Aware Pre-training Model for Traffic Classification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZIY5EFPK}},
  note         = {Machine review of arXiv:2508.19924}
}
read the original abstract

Network traffic classification using pre-training models has shown promising results, but existing methods struggle to capture packet structural characteristics, flow-level behaviors, hierarchical protocol semantics, and inter-packet contextual relationships. To address these challenges, we propose FlowletFormer, a BERT-based pre-training model specifically designed for network traffic analysis. FlowletFormer introduces a Coherent Behavior-Aware Traffic Representation Model for segmenting traffic into semantically meaningful units, a Protocol Stack Alignment-Based Embedding Layer to capture multilayer protocol semantics, and Field-Specific and Context-Aware Pretraining Tasks to enhance both inter-packet and inter-flow learning. Experimental results demonstrate that FlowletFormer significantly outperforms existing methods in the effectiveness of traffic representation, classification accuracy, and few-shot learning capability. Moreover, by effectively integrating domain-specific network knowledge, FlowletFormer shows better comprehension of the principles of network transmission (e.g., stateful connections of TCP), providing a more robust and trustworthy framework for traffic analysis.

Figures

Figures reproduced from arXiv: 2508.19924 by the authors.

Figure 1
Figure 1. Flowlet and Field Tokenization. To overcome this issue, we propose Flowlet and Field Tokenization as shown in [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. The flowchart of the FlowletFormer. overlook the unique characteristics of traffic. Unlike natural language, traffic has a layered protocol structure, different forms of alignment and distribution. Thus, we introduce a Protocol Stack Alignment-Based Embedding Layer into the existing embedding module. This embedding layer is specifically designed for traffic data and explicitly encodes the protocol layer associated w… view at source ↗
Figure 3
Figure 3. Ablation Study of key components in Flowlet￾Former. The abbreviations are explained as follows: FL: Flowlet and Field Tokenization, MFM: Masked Field Model, FPT: Flowlet Prediction Task, PE: Protocol Stack Alignment-Based Embedding Layer, and PT: Pre-Training. we use the full dataset as the reference and randomly sam￾ple 40%, 20%, and 10% of the available data for few-shot training. Our few-shot evaluation on ISCX-V… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Few-shot Analysis [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

52 extracted references · 44 canonical work pages

  1. [1]

    W.; and Thuraisingham, B

    Al - Naami, K.; Chandra, S.; Mustafa, A.; Khan, L.; Lin, Z.; Hamlen, K. W.; and Thuraisingham, B. 2016. Adaptive encrypted traffic fingerprinting with bi-directional dependence. In Schwab, S.; Robertson, W. K.; and Balzarotti, D., eds., Proceedings of the 32nd Annual Conference on Computer Security Applications, ACSAC 2016, Los Angeles, CA, USA, December ...

    work page 2016

  2. [2]

    Aouedi, O.; Piamrat, K.; Hamma, S.; and Kuranage, M. P. J. 2022. Network traffic analysis using machine learning: an unsupervised approach to understand and slice your network. Ann. des T \' e l \' e communications , 77(5-6): 297--309

    work page 2022

  3. [3]

    Cho, K.; Mitsuya, K.; and Kato, A. 2000. Traffic Data Repository at the WIDE Project. In Proceedings of the Freenix Track: 2000 USENIX Annual Technical Conference, June 18-23, 2000, San Diego, CA, USA , 263--270. USENIX

    work page 2000

  4. [4]

    Chung, J.; Cho, K.; and Bengio, Y. 2016. A Character-level Decoder without Explicit Segmentation for Neural Machine Translation. CoRR, abs/1603.06147

    arXiv 2016

  5. [5]

    K.; Zohourian, A.; Truong, K

    Dadkhah, S.; Mahdikhani, H.; Danso, P. K.; Zohourian, A.; Truong, K. A.; and Ghorbani, A. A. 2022. Towards the Development of a Realistic Multidimensional IoT Profiling Dataset. In 19th Annual International Conference on Privacy, Security & Trust, PST 2022, Fredericton, NB, Canada, August 22-24, 2022 , 1--11. IEEE

    work page 2022

  6. [6]

    Devlin, J.; Chang, M.; Lee, K.; and Toutanova, K. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. In Burstein, J.; Doran, C.; and Solorio, T., eds., Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, NAACL-HLT 2019, Minneapo...

    work page 2019

  7. [7]

    H.; Mamun, M

    Draper - Gil, G.; Lashkari, A. H.; Mamun, M. S. I.; and Ghorbani, A. A. 2016. Characterization of Encrypted and VPN Traffic using Time-related Features. In Camp, O.; Furnell, S.; and Mori, P., eds., Proceedings of the 2nd International Conference on Information Systems Security and Privacy, ICISSP 2016, Rome, Italy, February 19-21, 2016 , 407--414. SciTePress

    work page 2016

  8. [8]

    Eddy, W. 2022. Rfc 9293: Transmission control protocol (tcp)

    work page 2022

Show all 52 references
  1. [9]

    Gage, P. 1994. A new algorithm for data compression. C Users J., 12(2): 23–38

    1994

  2. [10]

    Gutterman, C.; Guo, K.; Arora, S.; Wang, X.; Wu, L.; Katz - Bassett, E.; and Zussman, G. 2019. Requet: real-time QoE detection for encrypted YouTube traffic. In Zink, M.; Toni, L.; and Begen, A. C., eds., Proceedings of the 10th ACM Multimedia Systems Conference, MMSys 2019, A...

    2019

  3. [11]

    Y.; Yang, Z

    He, H. Y.; Yang, Z. G.; and Chen, X. N. 2020. PERT: Payload Encoding Representation from Transformer for Encrypted Traffic Classification. In 2020 ITU Kaleidoscope: Industry-Driven Digital Transformation, Kaleidoscope, Ha Noi, Vietnam, December 7-11, 2020 , 1--8. IEEE

    2020

  4. [12]

    Hu, X.; Gao, W.; Cheng, G.; Li, R.; Zhou, Y.; and Wu, H. 2023. Toward Early and Accurate Network Intrusion Detection Using Graph Embedding. IEEE Trans. Inf. Forensics Secur. , 18: 5817--5831

    2023

  5. [13]

    F.; and Ross, K

    Kurose, J. F.; and Ross, K. W. 2001. Computer networking - a top-down approach featuring the internet. Addison-Wesley-Longman. ISBN 978-0-201-47711-5

    2001

  6. [14]

    Lan, Z.; Chen, M.; Goodman, S.; Gimpel, K.; Sharma, P.; and Soricut, R. 2020. ALBERT: A Lite BERT for Self-supervised Learning of Language Representations. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020 . OpenReview.net

    2020

  7. [15]

    H.; Draper - Gil, G.; Mamun, M

    Lashkari, A. H.; Draper - Gil, G.; Mamun, M. S. I.; and Ghorbani, A. A. 2017. Characterization of Tor Traffic using Time based Features. In Mori, P.; Furnell, S.; and Camp, O., eds., Proceedings of the 3rd International Conference on Information Systems Security and Privacy, I...

    2017

  8. [16]

    Lin, X.; Xiong, G.; Gou, G.; Li, Z.; Shi, J.; and Yu, J. 2022. ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification. In Laforest, F.; Troncy, R.; Simperl, E.; Agarwal, D.; Gionis, A.; Herman, I.; and M \' e dini,...

    2022

  9. [17]

    Liu, C.; He, L.; Xiong, G.; Cao, Z.; and Li, Z. 2019 a . FS-Net: A Flow Sequence Network For Encrypted Traffic Classification. In 2019 IEEE Conference on Computer Communications, INFOCOM 2019, Paris, France, April 29 - May 2, 2019 , 1171--1179. IEEE

    2019

  10. [18]

    Liu, Y.; Ott, M.; Goyal, N.; Du, J.; Joshi, M.; Chen, D.; Levy, O.; Lewis, M.; Zettlemoyer, L.; and Stoyanov, V. 2019 b . RoBERTa: A Robustly Optimized BERT Pretraining Approach. CoRR, abs/1907.11692

    2019 arXiv

  11. [19]

    J.; Zade, R

    Lotfollahi, M.; Siavoshani, M. J.; Zade, R. S. H.; and Saberian, M. 2020. Deep packet: a novel approach for encrypted traffic classification using deep learning. Soft Comput., 24(3): 1999--2012

    2020

  12. [20]

    Luong, M.; and Manning, C. D. 2016. Achieving Open Vocabulary Neural Machine Translation with Hybrid Word-Character Models. CoRR, abs/1604.00788

    2016 arXiv

  13. [21]

    B.; Meng, Z.; and Alizadeh, M

    Mao, H.; Schwarzkopf, M.; Venkatakrishnan, S. B.; Meng, Z.; and Alizadeh, M. 2019. Learning scheduling algorithms for data processing clusters. In Wu, J.; and Hall, W., eds., Proceedings of the ACM Special Interest Group on Data Communication, SIGCOMM 2019, Beijing, China, Aug...

    2019

  14. [22]

    J.; Alyafeai, Z.; Salesky, E.; Raffel, C.; Dey, M.; Gall \'e , M.; Raja, A.; Si, C.; Lee, W

    Mielke, S. J.; Alyafeai, Z.; Salesky, E.; Raffel, C.; Dey, M.; Gall \'e , M.; Raja, A.; Si, C.; Lee, W. Y.; Sagot, B.; et al. 2021. Between words and characters: A brief history of open-vocabulary modeling and tokenization in NLP. arXiv preprint arXiv:2112.10508

    2021 arXiv

  15. [23]

    D.; and Tygar, J

    Miller, B.; Huang, L.; Joseph, A. D.; and Tygar, J. D. 2014. I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis. In Cristofaro, E. D.; and Murdoch, S. J., eds., Privacy Enhancing Technologies - 14th International Symposium, PETS 2014, Amsterdam,...

    2014

  16. [24]

    Panchenko, A.; Lanze, F.; Pennekamp, J.; Engel, T.; Zinnen, A.; Henze, M.; and Wehrle, K. 2016. Website Fingerprinting at Internet Scale. In 23rd Annual Network and Distributed System Security Symposium, NDSS 2016, San Diego, California, USA, February 21-24, 2016 . The Interne...

    2016

  17. [25]

    Papadogiannaki, E.; and Ioannidis, S. 2022. A Survey on Encrypted Network Traffic Analysis Applications, Techniques, and Countermeasures. ACM Comput. Surv. , 54(6): 123:1--123:35

    2022

  18. [26]

    E.; Neumann, M.; Iyyer, M.; Gardner, M.; Clark, C.; Lee, K.; and Zettlemoyer, L

    Peters, M. E.; Neumann, M.; Iyyer, M.; Gardner, M.; Clark, C.; Lee, K.; and Zettlemoyer, L. 2018. Deep contextualized word representations. CoRR, abs/1802.05365

    2018 arXiv

  19. [27]

    Postel, J. 1980. Rfc 0768: User datagram protocol

    1980

  20. [28]

    Postel, J. 1981 a . Internet protocol. Technical report

    1981

  21. [29]

    Postel, J. 1981 b . Rfc 792: Internet Control Message Protocol darpa internet program protocol specification

    1981

  22. [30]

    Radford, A.; Narasimhan, K.; Salimans, T.; Sutskever, I.; et al. 2018. Improving language understanding by generative pre-training

    2018

  23. [31]

    Rezaei, S.; and Liu, X. 2019. Deep Learning for Encrypted Traffic Classification: An Overview. IEEE Commun. Mag. , 57(5): 76--81

    2019

  24. [32]

    Roesch, M. 1999. Snort: Lightweight Intrusion Detection for Networks. In Parter, D. W., ed., Proceedings of the 13th Conference on Systems Administration (LISA-99), Seattle, WA, USA, November 7-12, 1999, 229--238. USENIX

    1999

  25. [33]

    Schuster, R.; Shmatikov, V.; and Tromer, E. 2017. Beauty and the Burst: Remote Identification of Encrypted Video Streams. In Kirda, E.; and Ristenpart, T., eds., 26th USENIX Security Symposium, USENIX Security 2017, Vancouver, BC, Canada, August 16-18, 2017 , 1357--1374. USENI...

    2017

  26. [34]

    Sennrich, R.; Haddow, B.; and Birch, A. 2016. Neural Machine Translation of Rare Words with Subword Units. In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics, ACL 2016, August 7-12, 2016, Berlin, Germany, Volume 1: Long Papers . The Asso...

    2016

  27. [35]

    H.; and Ghorbani, A

    Sharafaldin, I.; Lashkari, A. H.; and Ghorbani, A. A. 2018. Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. In Mori, P.; Furnell, S.; and Camp, O., eds., Proceedings of the 4th International Conference on Information Systems Security...

    2018

  28. [36]

    Shen, M.; Liu, Y.; Zhu, L.; Xu, K.; Du, X.; and Guizani, N. 2020. Optimizing Feature Selection for Efficient Encrypted Traffic Classification: A Systematic Approach. IEEE Netw. , 34(4): 20--27

    2020

  29. [37]

    Shen, M.; Zhang, J.; Zhu, L.; Xu, K.; and Du, X. 2021. Accurate Decentralized Application Identification via Encrypted Traffic Analysis Using Graph Neural Networks. IEEE Trans. Inf. Forensics Secur. , 16: 2367--2380

    2021

  30. [38]

    Sirinam, P.; Imani, M.; Juarez, M.; and Wright, M. 2018. Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning. In Lie, D.; Mannan, M.; Backes, M.; and Wang, X., eds., Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Se...

    2018

  31. [39]

    Sommer, R.; and Paxson, V. 2010. Outside the Closed World: On Using Machine Learning for Network Intrusion Detection. In 31st IEEE Symposium on Security and Privacy, SP 2010, 16-19 May 2010, Berleley/Oakland, California, USA , 305--316. IEEE Computer Society

    2010

  32. [40]

    Tang, R.; Yang, Z.; Li, Z.; Meng, W.; Wang, H.; Li, Q.; Sun, Y.; Pei, D.; Wei, T.; Xu, Y.; and Liu, Y. 2020. ZeroWall: Detecting Zero-Day Web Attacks through Encoder-Decoder Recurrent Neural Networks. In 39th IEEE Conference on Computer Communications, INFOCOM 2020, Toronto, O...

    2020

  33. [41]

    F.; Spolaor, R.; Conti, M.; and Martinovic, I

    Taylor, V. F.; Spolaor, R.; Conti, M.; and Martinovic, I. 2016. AppScanner: Automatic Fingerprinting of Smartphone Apps from Encrypted Network Traffic. In IEEE European Symposium on Security and Privacy, EuroS & P 2016, Saarbr \" u cken, Germany, March 21-24, 2016 , 439--454. IEEE

    2016

  34. [42]

    J.; Lindorfer, M.; Choffnes, D

    van Ede, T.; Bortolameotti, R.; Continella, A.; Ren, J.; Dubois, D. J.; Lindorfer, M.; Choffnes, D. R.; van Steen, M.; and Peter, A. 2020. FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic. In 27th Annual Network and Distributed System Security ...

    2020

  35. [43]

    Vaswani, A. 2017. Attention is all you need. Advances in Neural Information Processing Systems

    2017

  36. [44]

    Wang, W.; Zhu, M.; Zeng, X.; Ye, X.; and Sheng, Y. 2017. Malware traffic classification using convolutional neural network for representation learning. In 2017 International Conference on Information Networking, ICOIN 2017, Da Nang, Vietnam, January 11-13, 2017 , 712--717. IEEE

    2017

  37. [45]

    Wu, Y.; Schuster, M.; Chen, Z.; Le, Q. V.; Norouzi, M.; Macherey, W.; Krikun, M.; Cao, Y.; Gao, Q.; Macherey, K.; Klingner, J.; Shah, A.; Johnson, M.; Liu, X.; Łukasz Kaiser; Gouws, S.; Kato, Y.; Kudo, T.; Kazawa, H.; Stevens, K.; Kurian, G.; Patil, N.; Wang, W.; Young, C.; Sm...

    2016 arXiv

  38. [46]

    Zhang, J.; Li, F.; Ye, F.; and Wu, H. 2020. Autonomous Unknown-Application Filtering and Labeling for DL-based Traffic Classifier Update. In 39th IEEE Conference on Computer Communications, INFOCOM 2020, Toronto, ON, Canada, July 6-9, 2020 , 397--405. IEEE

    2020

  39. [47]

    Zhao, R.; Zhan, M.; Deng, X.; Wang, Y.; Wang, Y.; Gui, G.; and Xue, Z. 2023. Yet Another Traffic Classifier: A Masked Autoencoder Based Traffic Transformer with Multi-Level Flow Representation. In Williams, B.; Chen, Y.; and Neville, J., eds., Thirty-Seventh AAAI Conference on...

    2023

  40. [48]

    Zhao, Z.; Chen, H.; Zhang, J.; Zhao, X.; Liu, T.; Lu, W.; Chen, X.; Deng, H.; Ju, Q.; and Du, X. 2019. UER : An Open-Source Toolkit for Pre-training Models. 241--246

    2019

  41. [49]

    Zhou, G.; Guo, X.; Liu, Z.; Li, T.; Li, Q.; and Xu, K. 2025. TrafficFormer: An Efficient Pre-trained Model for Traffic Data . In 2025 IEEE Symposium on Security and Privacy (SP), 102--102. IEEE Computer Society

    2025

  42. [50]

    Zuev, D.; and Moore, A. W. 2005. Traffic Classification Using a Statistical Approach. In Dovrolis, C., ed., Passive and Active Network Measurement, 6th International Workshop, PAM 2005, Boston, MA, USA, March 31 - April 1, 2005, Proceedings

    2005

  43. [51]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all...

  44. [52]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.