Cbr Encrypted Traffic Eval

cbr-encrypted-traffic-eval

CBR -- Boosting Adaptive Classification By Retrieval of Encrypted Network Traffic with Out-of-distribution — Lukach et al. (2024) (arXiv:2403.11206, 2024)

What this evaluates

Evaluates an ANN-based adaptive classifier's ability to classify encrypted network traffic into known categories such as malware families, operating systems, browsers, and applications. It specifically probes the model's capacity to dynamically adapt to new or out-of-distribution classes without retraining, while measuring any performance degradation on existing classes compared to traditional baselines.

Datasets

• BOA — total 20000; splits: train (-1), test (-1)
• MTA — total ?; splits: train (-1), test (-1)

Metrics

• classification performance (primary) — range: percent
  • Overall accuracy or F1-score computed over predicted class labels versus ground truth labels. The paper compares this metric against a Random Forest baseline to measure performance degradation when learning new classes.

Input / output format

Input: Encrypted network traffic sessions (PCAPs/flows) described by session duration, forward/backward packet counts, and traffic sizes.

Output: Discrete class labels corresponding to malware family, operating system, browser, or application type.

Scoring recipe

def compute_performance(predictions, gold):
    correct = sum(1 for p, g in zip(predictions, gold) if p == g)
    return correct / len(gold) * 100

Common pitfalls

• Threshold selection for OOD detection significantly impacts adaptation without retraining.
• Direct comparison with Random Forest requires careful handling of the few-shot vs. full-supervised training paradigm.
• Feature extraction from TLS-encrypted flows may vary across implementations, affecting reproducibility.

Evidence (verbatim from paper)

The goal of our evaluation was, first to assess the slight decrease in our classifier’s performance due to learning new classes, while classifying existing classes when comparing them to a classical machine learning classifier (e.g., RF). Second, to show the robustness of our ANN-based classifier in the classification of new classes.

Citation

@misc{lukach2024cbr,
  title={CBR -- Boosting Adaptive Classification By Retrieval of Encrypted Network Traffic with Out-of-distribution},
  author={Lukach et al. (2024)},
  year={2024},
  note={arXiv:2403.11206}
}

• arXiv: 2403.11206