arXiv cs.AI· Mayan Sharma, Kriti Saini, Devansh Behl·· 12 小时前AI 评分34
划分协议决定结果：重新评估加密流量分类
The Split Protocol Decides the Result: Re-Evaluating Encrypted Traffic Classification
AI 导读
同一模型和代码在两个公开语料之一上，按文献标准评估协议可得 macro-F1 0.992，但改用将同一次抓包流量保留在同一侧的划分协议后仅得 0.567，差距 0.426（八个随机种子，Holm-Bonferroni 校正后 p = 0.008）。
正文 · 原文
Abstract:Encrypted traffic classifiers are routinely reported at 95-99% accuracy. We show that on one of two public corpora, the same model and code score macro-F1 0.992 under the evaluation protocol standard in the literature and 0.567 under a protocol that keeps flows from one packet capture on one side of the split. Nothing changes but the partition (gap 0.426 over eight seeds, p = 0.008 after Holm-Bonferroni correction).
The inflation is not a property of random splitting as such. On a month of backbone QUIC traffic, we evaluate five split protocols at eight seeds each: random, temporal and client-disjoint splitting are statistically indistinguishable from session-disjoint, while server-disjoint splitting costs 0.192 macro-F1 (d = 17.0, p = 0.008). Which axis matters depends on how the corpus was collected, in a way invisible from its label space.
We give a diagnostic that identifies the right axis before any model is trained: single-identifier probes. A decision tree on the capture identifier alone reaches 0.983 under a random split and exactly 0.000 under session-disjoint splitting.
Under this evaluation, a metric-trained flow embedding leads four deep baselines but does not beat gradient-boosted trees on twenty packet sizes. Five of our own pre-registered architectural claims fail: distance-based rejection of unknown applications beats softmax thresholding, but ablating every metric objective makes rejection better, because class separation correlates at r = -0.88 with rejection quality. Few-shot enrollment is flat within a corpus but, across corpora, five labelled flows per class recover 91% of the deficit left by failed zero-shot transfer.
All splits, results, code and negative findings are released.
| Comments: | 12 pages, 4 figures, 6 tables Code and data splits: this https URL |
| Subjects: | Machine Learning (cs.LG); Artificial Intelligence (cs.AI) |
| ACM classes: | C.2.3; I.2.6 |
| Cite as: | arXiv:2611.06290 [cs.LG] |
| (or arXiv:2611.06290v1 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2611.06290 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Mayan Sharma [view email]
[v1]
Wed, 4 Nov 2026 10:25:50 UTC (75 KB)
来源：arXiv cs.AI · arxiv.org