arXiv subjects

Adrian Pekar

Publications and source records attributed to Adrian Pekar.

9 recordsLinked to original sources

arXiv2026

Matched-View Cross-Domain Evaluation of WireGuard VPN Traffic Classification Using Early-Flow Fingerprints

Classifying VPN-encrypted traffic by application category typically relies on datasets that collect non-VPN and VPN traffic in separate sessions, conflating encapsulation effects with session-level differences in user behavior, timing, and application mix. We use a recently published WireGuard tunnel dataset in which pre- and post-tunnel traffic is captured simultaneously, with a packet-level match ratio above 99.9%. This matched-capture design eliminates session-level confounds and enables a cross-domain benchmark: models are trained on non-VPN flows and tested on the VPN view of the same underlying flows. We compare whole-flow statistical aggregates (FlowFeatures) and Sequence of Packet Length and Time (SPLT) early-flow fingerprints across Random Forest, XGBoost, and a multi-scale CNN1D. Cross-domain transfer depends jointly on representation and model: tree ensembles achieve balanced accuracy of 0.84-0.93 with FlowFeatures but only 0.60-0.75 with flattened SPLT, whereas CNN1D processes the same SPLT fingerprint as a sequence and achieves the strongest transfer overall (balanced accuracy 0.98, macro F1 0.89) without any VPN data during training.

cs.NI↗

arXiv2026

Tutorial on Flow-Based Network Traffic Classification Using Machine Learning

Modern networks carry increasingly diverse and encrypted traffic types that demand classification techniques beyond traditional port-based and payload-based methods. This tutorial provides a practical, end-to-end guide to building machine-learning-based network traffic flow classification systems. We cover the workflow from flow metering and dataset creation, through ground-truth labeling and feature engineering, to leakage-resistant experimental design, model training and evaluation, explainability, and deployment considerations. The tutorial focuses on supervised flow-based classification that remains effective under encryption and provides actionable guidance on algorithm selection, performance metrics, and realistic partitioning strategies, with emphasis on common real-world measurement artifacts and methodological pitfalls. A companion set of five Jupyter notebooks on GitHub implements the data-to-model workflow on real traffic captures, enabling readers to reproduce key steps. The intended audience includes researchers and practitioners with foundational networking knowledge who aim to design and deploy robust traffic classification systems in operational environments.

cs.NI↗

arXiv2025

On the Feasibility of Inter-Flow Service Degradation Detection

Hardware acceleration in modern networks creates monitoring blind spots by offloading flows to a non-observable state, hindering real-time service degradation (SD) detection. To address this, we propose and formalize a novel inter-flow correlation framework, built on the hypothesis that observable flows can act as environmental sensors for concurrent, non-observable flows. We conduct a comprehensive statistical analysis of this inter-flow landscape, revealing a fundamental trade-off: while the potential for correlation is vast, the most explicit signals (i.e., co-occurring SD events) are sparse and rarely perfectly align. Critically, however, our analysis shows these signals frequently precede degradation in the target flow, validating the potential for timely detection. We then evaluate the framework using a standard machine learning model. While the model achieves high classification accuracy, a feature-importance analysis reveals it relies primarily on simpler intra-flow features. This key finding demonstrates that harnessing the complex contextual information requires more than simple models. Our work thus provides not only a foundational analysis of the inter-flow problem but also a clear outline for future research into the structure-aware models needed to solve it.

cs.NI↗

arXiv2025

Taming Volatility: Stable and Private QUIC Classification with Federated Learning

Federated Learning (FL) is a promising approach for privacy-preserving network traffic analysis, but its practical deployment is challenged by the non-IID nature of real-world data. While prior work has addressed statistical heterogeneity, the impact of temporal traffic volatility-the natural daily ebb and flow of network activity-on model stability remains largely unexplored. This volatility can lead to inconsistent data availability at clients, destabilizing the entire training process. In this paper, we systematically address the problem of temporal volatility in federated QUIC classification. We first demonstrate the instability of standard FL in this dynamic setting. We then propose and evaluate a client-side data buffer as a practical mechanism to ensure stable and consistent local training, decoupling it from real-time traffic fluctuations. Using the real-world CESNET-QUIC22 dataset partitioned into 14 autonomous clients, we then demonstrate that this approach enables robust convergence. Our results show that a stable federated system achieves a 95.2% F1 score, a mere 2.3 percentage points below a non-private centralized model. This work establishes a blueprint for building operationally stable FL systems for network management, proving that the challenges of dynamic network environments can be overcome with targeted architectural choices.

cs.NI↗

arXiv2025

Binary VPN Traffic Detection Using Wavelet Features and Machine Learning

Encrypted traffic classification faces growing challenges as encryption renders traditional deep packet inspection ineffective. This study addresses binary VPN detection, distinguishing VPN-encrypted from non-VPN traffic using wavelet transform-based features across multiple machine learning models. Unlike previous studies focused on application-level classification within encrypted traffic, we specifically evaluate the fundamental task of VPN identification regardless of application type. We analyze the impact of wavelet decomposition levels and dataset filtering on classification performance across significantly imbalanced data, where filtering reduces some traffic categories by up to 95%. Our results demonstrate that Random Forest (RF) achieves superior performance with an F1-score of 99%, maintaining robust accuracy even after significant dataset filtering. Neural Networks (NN) show comparable effectiveness with an F1-score of 98% when trained on wavelet level 12, while Support Vector Machines (SVM) exhibit notable sensitivity to dataset reduction, with F1-scores dropping from 90% to 85% after filtering. Comparing wavelet decomposition at levels 5 and 12, we observe improved classification performance at level 12, particularly for variable traffic types, though the marginal gains may not justify the additional computational overhead. These findings establish RF as the most reliable model for VPN traffic classification while highlighting key performance tradeoffs in feature extraction and preprocessing.

cs.NI↗

arXiv2024

AutoFlow: An Autoencoder-based Approach for IP Flow Record Compression with Minimal Impact on Traffic Classification

Network monitoring generates massive volumes of IP flow records, posing significant challenges for storage and analysis. This paper presents a novel deep learning-based approach to compressing these records using autoencoders, enabling direct analysis of compressed data without requiring decompression. Unlike traditional compression methods, our approach reduces data volume while retaining the utility of compressed data for downstream analysis tasks, including distinguishing modern application protocols and encrypted traffic from popular services. Through extensive experiments on a real-world network traffic dataset, we demonstrate that our autoencoder-based compression achieves a 1.313x reduction in data size while maintaining 99.27% accuracy in a multi-class traffic classification task, compared to 99.77% accuracy with uncompressed data. This marginal decrease in performance is offset by substantial gains in storage and processing efficiency. The implications of this work extend to more efficient network monitoring and scalable, real-time network management solutions.

cs.NI↗

arXiv2024

Early Detection of Network Service Degradation: An Intra-Flow Approach

This research presents a novel method for predicting service degradation (SD) in computer networks by leveraging early flow features. Our approach focuses on the observable (O) segments of network flows, particularly analyzing Packet Inter-Arrival Time (PIAT) values and other derived metrics, to infer the behavior of non-observable (NO) segments. Through a comprehensive evaluation, we identify an optimal O/NO split threshold of 10 observed delay samples, balancing prediction accuracy and resource utilization. Evaluating models including Logistic Regression, XGBoost, and Multi-Layer Perceptron, we find XGBoost outperforms others, achieving an F1-score of 0.74, balanced accuracy of 0.84, and AUROC of 0.97. Our findings highlight the effectiveness of incorporating comprehensive early flow features and the potential of our method to offer a practical solution for monitoring network traffic in resource-constrained environments. This approach ensures enhanced user experience and network performance by preemptively addressing potential SD, providing the basis for a robust framework for maintaining high-quality network services.

cs.NI↗

arXiv2024

Early-Stage Anomaly Detection: A Study of Model Performance on Complete vs. Partial Flows

This study investigates the efficacy of machine learning models in network security threat detection through the critical lens of partial versus complete flow information, addressing a common gap between research settings and real-time operational needs. We systematically evaluate how a standard benchmark model, Random Forest, performs under varying training and testing conditions (complete/complete, partial/partial, complete/partial), quantifying the performance impact when dealing with the incomplete data typical in real-time environments. Our findings demonstrate a significant performance difference, with precision and recall dropping by up to 30% under certain conditions when models trained on complete flows are tested against partial flows. The study also reveals that, for the evaluated dataset and model, a minimum threshold around 7 packets in the test set appears necessary for maintaining reliable detection rates, providing valuable, quantified insights for developing more realistic real-time detection strategies.

cs.LG↗

arXiv2024

Evaluating ML-Based Anomaly Detection Across Datasets of Varied Integrity: A Case Study

Cybersecurity remains a critical challenge in the digital age, with network traffic flow anomaly detection being a key pivotal instrument in the fight against cyber threats. In this study, we address the prevalent issue of data integrity in network traffic datasets, which are instrumental in developing machine learning (ML) models for anomaly detection. We introduce two refined versions of the CICIDS-2017 dataset, NFS-2023-nTE and NFS-2023-TE, processed using NFStream to ensure methodologically sound flow expiration and labeling. Our research contrasts the performance of the Random Forest (RF) algorithm across the original CICIDS-2017, its refined counterparts WTMC-2021 and CRiSIS-2022, and our NFStream-generated datasets, in both binary and multi-class classification contexts. We observe that the RF model exhibits exceptional robustness, achieving consistent high-performance metrics irrespective of the underlying dataset quality, which prompts a critical discussion on the actual impact of data integrity on ML efficacy. Our study underscores the importance of continual refinement and methodological rigor in dataset generation for network security research. As the landscape of network threats evolves, so must the tools and techniques used to detect and analyze them.

cs.LG↗