qhjqhj00 visquic-http3-response-estimation-eval
Exploring QUIC Dynamics: A Large-Scale Dataset for Encrypted Traffic Analysis — Gahtan et al. (2024) (arXiv:2410.03728, 2024)
What this evaluates
Evaluates a model's ability to estimate the number of HTTP/3 responses in encrypted QUIC traffic using only observable packet characteristics. It probes the capability to extract meaningful temporal and structural patterns from encrypted flows without plaintext inspection.
Datasets
- VisQUIC — total 100000; splits: train (-1), test (-1); repo https://github.com/robshahla/VisQUIC
Metrics
CAP±k(primary) — range: [0, 1]- Calculates the proportion of predictions within a specified tolerance k of the ground truth: CAP_±k(y, ŷ) = (1/n) Σ 1(|y_i - ŷ_i| ≤ k). Unlike exact-match metrics, it rewards near-correct predictions.
Input / output format
Input: Structured (32 × 32) RGB images representing QUIC packet traces, generated via a sliding window of length T (0.1 or 0.3 seconds) over observable packet characteristics.
Output: Integer representing the predicted number of HTTP/3 responses for the given trace/window.
Scoring recipe
def cap_metric(y_true, y_pred, k):
correct = sum(1 for yt, yp in zip(y_true, y_pred) if abs(yt - yp) <= k)
return correct / len(y_true)
Common pitfalls
- Class imbalance causes wider prediction variance for higher response counts.
- Longer temporal windows (T=0.3) accumulate errors across multiple images per trace, reducing accuracy compared to finer granularity (T=0.1).
- Non-order-preserving data augmentations disrupt temporal dependencies in the image representations.
Evidence (verbatim from paper)
To assess accuracy, we introduce the Cumulative Accuracy Profile (CAP) metric, which quantifies the proportion of predictions within a specified tolerance of the ground truth. $$ \mathrm {C A P} _ {\pm k} (\mathbf {y}, \hat {\mathbf {y}}) = \frac {1}{n} \sum_ {i = 1} ^ {n} \mathbb {1} \left(\left| y _ {i} - \hat {y} _ {i} \right| \leq k\right), \tag {1} $$ where $\mathbf{y}$ represents the vector of true class labels, $\hat{\mathbf{y}}$ denotes model predictions, $k$ specifies the tolerance level ( $\pm 1$ or $\pm 2$ classes), and $n$ is the total number of samples.
Citation
@misc{gahtan2024visquic,
title={Exploring QUIC Dynamics: A Large-Scale Dataset for Encrypted Traffic Analysis},
author={Gahtan et al. (2024)},
year={2024},
note={arXiv:2410.03728}
}
- arXiv: 2410.03728