Eun Hun Choi | Searcharxiv

arXiv2026

FlowCLIP: Contrastive Pretraining Using Domain Names for Encrypted Traffic Classification

Network traffic classification enables website fingerprinting, intrusion detection, and quality of service management. However, developing methods that capture stable and generalizable traffic patterns remains challenging. We introduce FlowCLIP, a contrastive pretraining framework for learning traffic representations using only side-channel features: packet inter-arrival times, packet sizes, and packet directions. FlowCLIP feeds traffic flow features into a traffic encoder and the corresponding domain names into a text encoder, aligning their learned representations through a CLIP-style contrastive loss. After pretraining on the CESNET-QUIC22 dataset, we freeze the traffic encoder and evaluate it through linear probing. We also assess whether the pretrained representations transfer to a separate dataset, the UC Davis dataset. Through these evaluations, we show that domain names can be used directly for traffic representation learning without defining traffic classes.

cs.NI↗

arXiv2025

Confidence Driven Classification of Application Types in the Presence of Background Network Traffic

Accurately classifying the application types of network traffic using deep learning models has recently gained popularity. However, we find that these classifiers do not perform well on real-world traffic data due to the presence of non-application-specific generic background traffic originating from advertisements, analytics, shared APIs, and trackers. Unfortunately, state-of-the-art application classifiers overlook such traffic in curated datasets and only classify relevant application traffic. To address this issue, when we label and train using an additional class for background traffic, it leads to additional confusion between application and background traffic, as the latter is heterogeneous and encompasses all traffic that is not relevant to the application sessions. To avoid falsely classifying background traffic as one of the relevant application types, a reliable confidence measure is warranted, such that we can refrain from classifying uncertain samples. Therefore, we design a Gaussian Mixture Model-based classification framework that improves the indication of the deep learning classifier's confidence to allow more reliable classification.

cs.NI↗