Shortcut in Generalization: Rethinking Evaluation Protocol for Encrypted Traffic Classification

Shortcut in Generalization: Rethinking Evaluation Protocol for Encrypted Traffic Classification Qiming Yu1 , Chungang Lin2,3 , Zhengyi Ma4 , Zijia Song1 , Yuliang Lu1 , Guozheng Yang1 , Dongzhen Qi1 1

arXiv:2610.17961v1 [cs.NI] 13 Oct 2026

College of Electronic Engineering, National University of Defence Technology, Hefei 230037, China 2 Institute of Computing Technology, Chinese Academy of Sciences, China 3 University of Chinese Academy of Sciences, China 4 College of Computer Science and Technology, National University of Defence Technology, Changsha 410000, China Corresponding author: yangguozheng17nudt.edu.cn

Abstract—Encrypted traffic classification is commonly evaluated under a range of experimental protocols, with classification performance reported as the primary measure. However, the reported performance may be influenced by shortcuts left uncontrolled in the evaluation protocol, such as shortcut features and cross-partition sharing, rather than reflect generalizable traffic patterns. And test-only feature transformations may further introduce train–test mismatch. In this paper, we study how current evaluation protocols are affected by shortcut-related factors, including field-level shortcuts, cross-partition sharing, and train–test processing. We compare feature importance, retrained feature removal, and field-only split sensitivity. We also vary Source-IP overlap and packets per flow, compare test-only IP transformations with matched train–test transformations. Experiments on three public datasets show that the performance of existing methods are affected by both cross-partition sharing and the consistency of train–test transformations. Specifically, increasing Source-IP overlap from 0% to 100% raises accuracy by about 32–33 points before identifier masking, compared with only about 8 points after masking. For two state-of-the-art pretrained models (i.e., YaTC and NetMamba), the 11–13 points loss caused by test-only IP zeroing is almost fully recovered when the same transformation is applied during both training and testing. Index Terms—encrypted traffic classification, evaluation methodology, shortcut learning, data splitting, field interventions

I. I NTRODUCTION Encrypted traffic classification (ETC) supports network management and security monitoring. Existing methods range from lightweight classifiers built on packet features [1]–[3] to pre-trained models such as ET-BERT, YaTC, NetMamba [4]– [6]. Recent methods report very high accuracy and F1 scores on commonly used benchmarks. As benchmark performance becomes increasingly high, it becomes equally important to understand what contributes to these scores. In other words: if the factors the model relies on are not close to reality, then the performance of the model is actually artificially high. This raises a question: What do current ETC evaluations actually measure? In fact, the dataset split does more than divide samples. It also determines which identifiers and repeated observations remain shared across the two partitions. Identifier fields and repeated observations may form stable associations with labels, allowing a model to exploit shortcuts rather than

learning broader traffic patterns [7]–[9]. Field masking and entity-based grouping address different parts of this problem: masking changes the information visible to the classifier, whereas grouping changes what can be shared across training and test. Descriptions such as packet-level random split or flow-level split therefore do not fully specify the resulting evaluation condition. A second issue appears when feature dependence is inferred from test-time perturbations. If an IP field is removed or remapped only at test time, the input representation no longer matches the one used for training. The resulting performance loss can therefore reflect both information removal and train–test mismatch. Training and testing on the same transformed representation asks a different question: how well can the model perform when the transformation is applied consistently? Distinguishing these two settings is necessary before a test-only drop is interpreted as evidence of feature dependence. To separate these factors, we examine ETC evaluation from three complementary directions, as summarized in Fig. 1: (1) Field-level diagnostics: We compare importance stability, retrained removal effects, and field-only split sensitivity to characterize different forms of association between individual traffic fields and classification outcomes. (2) Cross-partition sharing: We examine the grouping object and directly control source-IP overlap and the number of packets retained per flow to measure how shared identities and related observations affect evaluation results. (3) Train–test transformations: We compare test-only IP perturbations with matched train–test preprocessing and measure the residual performance gap after matched training. Experiments on three public datasets produce three main observations: (1) Feature importance and field sensitivity are not equivalent. A field that appears unimportant in one setting can still form a strong split-sensitive label association in another; (2) Increasing Source-IP overlap from 0% to 100% raises accuracy by about 32 points before identifier masking, but only about 8 points after masking;(3) Test-only IP zeroing causes an 11–13 points loss for YaTC and NetMamba, yet this loss is almost fully recovered under matched train–test processing, while ET-BERT/CSTNET retains a 47.1 points residual. Together, these results show that ETC scores depend

correlations introduced during dataset construction and partitioning, leading to overly optimistic performance estimates. These findings motivate closer examination of how ETC benchmarks are constructed, partitioned, and evaluated.

Raw Encrypted Traffic Representation

Field-text TF-IDF

Byte-based

LinearSVC

Field-Level Diagnostics

ET-BERT

YaTC

NetMamba

Cross-Partition Sharing

Train-Test Transformations

Importance Stability

Grouping Object

Test-Only Perturbation

Removal Effect

Source-IP Overlap

Matched Preprocessing

Split Sensitivity

Packets per Flow

Residual Gap

Evaluation Findings

Fig. 1: Overview of the evaluation framework. on both what is shared across partitions and how input transformations are applied. The main contributions are as follows: 1) We show that feature importance, retrained removal effect and field-only split sensitivity capture different properties of traffic fields. 2) We treat cross-partition sharing as an experimental variable by controlling Source-IP overlap and the number of packets retained per flow. The results show that shared identities and repeated observations can substantially change measured performance. 3) We use matched train–test transformations to distinguish test-only perturbation sensitivity from performance under consistent preprocessing. This comparison shows when a large test-only loss can be recovered through matched training and testing instead of being attributed directly to feature dependence. II. R ELATED W ORK A. Encrypted Traffic Classification Encrypted traffic classification has evolved from methods based on handcrafted packet and flow statistics [1]–[3], [10] to models that learn representations directly from traffic data. ET-BERT learns contextualized representations from packetlevel datagrams [4], while YaTC and NetMamba model information across multiple packets within a flow [5], [6]. These models operate on representations ranging from individual packet bytes to multi-packet flow inputs. Recent studies have questioned whether high benchmark performance translates to reliable classification beyond the evaluated train–test split. The SoK by Wickramasinghe et al. [11] identifies dataset and evaluation design choices that can substantially affect encrypted traffic classification results. Zhao et al. [8] further show that, under conventional evaluation settings, representation learning models can exploit

B. Cross-Partition Sharing and Shortcut Learning Train–test partitioning determines which traffic entities and related observations may remain shared across the two partitions. General studies of security machine learning have emphasized the need to separate related objects across training and test sets [9], [12], while recent ETC studies show that packet-level random splitting can place packets or related observations from the same flow on both sides of the partition [8]. Such cases are often discussed as forms of train– test leakage, but they differ in the entities or observations that remain shared across partitions. Flow- or group-aware splitting reduces specific forms of cross-partition sharing, but the resulting evaluation still depends on the grouping object used to construct the split. Recent assessments of network-security and encryptedtraffic benchmarks also show that dataset construction and evaluation choices can strongly affect reported performance [11], [13]. Shortcut learning occurs when a model relies on predictive correlations that do not capture the intended task semantics [7]. In encrypted traffic classification, such correlations can arise from protocol and header fields whose values are specific to a dataset, host, session, or collection environment. For example, BiasSeeker [14] uses statistical association and field-level interventions to identify and validate potential shortcut features across traffic datasets. Traffic filtering studies have also shown that preprocessing choices can change the information available to a classifier [15]. Existing field-level diagnostics use different forms of evidence, including feature importance and performance changes after field removal or transformation. However, these measurements characterize different aspects of field dependence and need not lead to the same conclusion. Field intervention introduces a separate issue: when a transformation is applied only at test time, the model is evaluated on an input representation different from the one used during training. The resulting performance drop may therefore reflect dependence on information carried by the modified field, sensitivity to the resulting train–test mismatch, or both. III. M ETHODOLOGY A. Problem Setup and Input Representations We study encrypted traffic classification under different input representations and train–test partitioning rules. Given a labeled traffic dataset, an evaluation protocol partitions it into training and test sets and measures classification performance on the held-out samples. Our goal is to examine how this measured performance changes with the information available to the classifier, the entities shared across partitions, and the way input transformations are applied during training and testing.

We use two input representations with different measurement roles. The field-text view represents explicit packet fields as textual field–value tokens and encodes them with TFIDF features. It is used for field importance, feature removal, masking, and field-only diagnostics. The byte-based view uses packet byte sequences or multi-packet flow representations and is used to evaluate ET-BERT, YaTC, and NetMamba with their own model inputs. The field-text analysis therefore diagnoses explicit field associations rather than serving as a surrogate explanation of the byte-based models. The sample unit also varies with the evaluated representation. Packet-level experiments treat individual packets as samples, whereas flow-level experiments construct one sample from multiple packets belonging to the same bidirectional parent flow. For the latter, the main experiments use the first five packets of each flow. The exact dataset, sample unit, and model assignment are reported in Section IV-A. All grouping keys are derived from the original traffic records before any masking or byte transformation is applied. The same sample identities are then reused by the corresponding transformed conditions. Thus, changing an input representation does not change how the underlying samples are assigned to training and test sets. B. Field-level Diagnostics We use several complementary measurements to examine whether a traffic field forms a stable predictive association. The first measurement is feature-importance stability over 22 packet fields. Four importance methods are used: mutual information, coefficients from L1 -regularized logistic regression, random-forest feature importance, and single-feature decisiontree accuracy. Each method is evaluated over three random seeds, and the five highest-ranked fields are recorded for each run. For a field f , we define its stability as M

Stability(f ) =

R

1 XX 1 [f ∈ Top-K(m, r)] , M R m=1 r=1

(1)

where M = 4 is the number of importance methods, R = 3 is the number of random seeds, and K = 5. A higher value indicates that the field is repeatedly ranked among the most predictive fields across methods and seeds. Feature importance alone does not measure the performance contribution of a field. We therefore retrain the classifier after removing each field. Let FS (all) denote the Macro-F1 under split rule S using all fields, and let FS (mask f ) denote the score after field f is removed and the classifier is retrained. The retrained removal effect is UfS = FS (all) − FS (mask f ).

(2)

We further measure whether a field alone remains predictive when the partitioning rule changes. Let ASf denote the MacroF1 of a classifier trained using only field f under split rule S.

Using Packet-Random as the reference partition, the field-only split sensitivity is S S DA,f = APR f − Af ,

(3)

S where PR denotes Packet-Random. A larger DA,f indicates that the predictive value of field f decreases more strongly when the corresponding grouping constraint is introduced. As an auxiliary statistic, we also use

Pf = Of Qf ,

(4)

where Of describes the cross-partition overlap of field values and Qf describes their label specificity. Pf is used only to summarize whether a field provides stable value–label correspondences in a given dataset. We define four cumulative masking levels: L0 Retains all original fields. L1 Masks MAC addresses and frame.number. L2 Additionally masks source and destination IP addresses, including IPv6 addresses. L3 Further masks transport-layer ports. Each condition is trained independently on its corresponding masked representation. The L0–L3 comparison therefore measures performance after masking and retraining rather than a test-time perturbation. C. Train–Test Partitioning and Cross–Partition Sharing Train–test partitioning determines which traffic entities can remain shared between the two sides of an evaluation. We therefore describe each split by its grouping object rather than treating the split rules as an ordered hierarchy. Packet-Random assigns individual packets randomly to the two partitions. IP-pair grouped keeps packets with the same undirected source–destination IP pair on the same side. Source-IP grouped groups packets by ip.src. Parent-flow grouped keeps all packets from the same bidirectional parent flow together. For flow-level samples, Flow-Random randomly assigns the first-k representation of each parent flow, whereas Initiator-disjoint keeps flows with the same initiator on the same side while preserving parentflow integrity. These rules remove different forms of cross-partition sharing. For each split, we therefore record the overlap of relevant entities, including Source IPs, IP pairs, and parent flows, instead of inferring overlap from the split name alone. For a group-aware split, all samples belonging to the specified grouping object are assigned to one partition, so the corresponding training and test groups are disjoint. We further vary cross-partition sharing directly. In the Source-IP overlap experiment, the proportion of source identities appearing in both partitions is controlled from no overlap to complete overlap while keeping the remaining evaluation procedure fixed. In the packets-per-flow experiment, the number of packets contributed by each parent flow is varied from

TABLE I Datasets and input settings.

Packet random IP-pair grouped

Field-text view

Byte-based view

CSTNET-TLS 1.3 ISCXVPN USTC-TFC

Packet / TF-IDF Packet / TF-IDF Packet / TF-IDF

Packet / bytes Flow / first-5 Flow / first-5

Field-text uses a 10,000-dimensional TF-IDF representation with 1–3-grams. Flow inputs contain the first five packets of each parent flow.

one packet to multiple packets and finally to all available packets. This controls how many related observations from the same flow can be distributed across a packet-level random split.

100

Macro-F1 (%)

Dataset

(a) CSTNET-TLS 1.3

Source-IP grouped Parent-flow grouped

(b) ISCXVPN

(c) USTC-TFC

80 60 40 20

L0

L1

L2

L3

L0

L1

L2

L3

L0

L1

L2

L3

Masking level Fig. 2: Interaction between field masking and train–test grouping.

D. Train–Test Transformations Field perturbations can be evaluated either only at test time or consistently during both training and testing. To distinguish these cases, we construct a train–test transformation matrix over four byte-based input versions. R retains the original IP addresses, P applies per-flow IP and Z zeros the IP fields. For t ∈ {P, Z}, we compare the original condition R → R, the test-only condition R → t, and the matched condition t → t. We refer to their differences as the test-only drop, recovery after matched training and residual gap. The byte transformations are distinct from the field-text masking levels defined in Section III-B. In particular, Z modifies only IP fields in the byte representation and is not equivalent to L2, while P removes stable cross-flow address identity rather than applying one global anonymization map. Each training condition is optimized independently under the same model-specific training protocol. The comparison between R → t and t → t therefore separates sensitivity to a test-only perturbation from the performance achievable after matched train–test processing. IV. E XPERIMENTS AND F INDINGS We evaluate the factors defined in Section III from three perspectives: field masking, cross-partition sharing, and train– test transformations. We first establish how masking and grouping interact, and then use controlled experiments to examine the mechanisms behind the observed differences. A. Experimental Setup a) Datasets and input representations: We conduct experiments on CSTNET-TLS 1.3, ISCXVPN [16], and USTCTFC [17]. The field-text view uses packet-level field–value tokens represented by 10,000-dimensional TF-IDF features with 1–3-grams. The byte-based experiments use packet-byte inputs for ET-BERT and first-5-packet flow representations for YaTC and NetMamba, as summarized in Table I. LinearSVC is used with the field-text representation and as a lightweight reference in the controlled experiments.

b) Models and evaluation: We evaluate LinearSVC together with three representative ETC models: ET-BERT [4], YaTC [5], and NetMamba [6]. Model-specific inputs follow their corresponding preprocessing pipelines, and paired conditions use the same training configuration and checkpoint rule. Macro-F1 is the primary metric for the masking, fielddiagnostic, and transformation experiments. The controlled Source-IP overlap and packets-per-flow experiments report accuracy or accuracy differences. Most field and split experiments use five random seeds, whereas the ET-BERT Source-IP overlap and train–test transformation experiments use three. Figures report mean ± one standard deviation unless stated otherwise, and metric differences are reported in percentage points. B. Masking and Train–Test Splitting Figure 2 shows how cumulative field masking interacts with four train–test grouping rules across the three datasets. CSTNET-TLS 1.3 shows the strongest interaction: SourceIP grouping reduces L0 Macro-F1 to 37.58%, after which additional masking changes performance only slightly. On ISCXVPN, Parent-flow grouping instead decreases from 68.42% at L0 to 60.08% at L3. USTC-TFC retains higher performance overall, but also shows substantial differences across grouping rules. These results indicate that the effect of masking depends on the cross-partition sharing induced by the grouping rule. C. Field-level Diagnostics Table II compares importance stability, field-only split sensitivity, and retrained removal effects for eight representative fields. The three diagnostics are not interchangeable because they characterize different properties of a field. Importance stability measures how consistently a field is ranked as predictive, whereas the retrained removal effect measures its marginal contribution when the classifier is allowed to adapt to its absence. Field-only split sensitivity instead measures how strongly the predictive value of a field depends on the partitioning rule.

TABLE II Representative field-level diagnostic results. CSTNET

Field ip.src ip.dst tcp.srcport tcp.dstport tcp.window_size tcp.seq tcp.ack frame.len

ISCXVPN

TABLE III Macro-F1 under Flow-Random and initiator-disjoint USTC

Stab.

Rem.

Sens.

Rem.

Sens.

Rem.

91.7 66.7 0.0 0.0 50.0 0.0 0.0 25.0

22.4 -0.4 0.1 0.0 2.7 0.0 0.0 0.1

13.7 12.4 43.1 48.0 29.3 21.6 28.4 10.8

1.2 1.0 0.0 0.1 0.1 0.2 0.0 0.0

25.2 29.3 22.3 28.1 7.4 9.5 10.4 6.8

0.2 0.2 1.3 1.9 0.7 0.0 0.1 0.0

30

ET-BERT L0 ET-BERT L3

PR - PF Accuracy (pp)

Accuracy (pp)

(a) Source-IP overlap

20 10 0 0

25

50

75

Source-IP overlap (%)

100

Flow-Random

LinearSVC YaTC NetMamba

ISCXVPN 50.2 ± 1.3 18.9 ± 1.9 78.3 ± 0.8 23.2 ± 2.5 72.6 ± 3.6 23.6 ± 2.6

31.4 55.1 49.0

LinearSVC YaTC NetMamba

USTC-TFC 97.8 ± 0.3 74.1 ± 2.5 99.1 ± 0.1 75.2 ± 2.5 98.7 ± 0.2 75.4 ± 2.9

23.7 23.8 23.3

USTC-TFC L0 USTC-TFC L3

Model

2

4

8

Packets per flow

All

Fig. 3: Controlled cross-partition sharing experiments. (a) Effect of Source-IP overlap. (b) Effect of packets per flow. These distinctions are visible in Table II. On CSTNETTLS 1.3, ip.src has both high importance stability (91.7%) and a large removal effect (22.4 points), whereas ip.dst has relatively high stability (66.7%) but almost no removal effect. On ISCXVPN, tcp.dstport shows a 48.0 points split sensitivity but only a 0.1 points removal effect. Thus, a field can exhibit a strong or split-sensitive predictive association without making a correspondingly large marginal contribution to the retrained full-field classifier. D. Controlled Cross-Partition Sharing We next control two forms of cross-partition sharing directly. Figure 3 varies Source-IP overlap and the number of packets contributed by each parent flow. a) Source-IP overlap: At 100% overlap, the L0 accuracy gain reaches 33.29 points for LinearSVC and 32.05 points for ET-BERT, whereas the corresponding L3 gains are only about 8 points. The effect of Source-IP sharing is therefore substantially reduced after identifier masking. b) Packets per flow: The Packet-Random–Parent-flow gap is near zero with one packet per flow and grows as additional packets from the same flow are retained. At L0, the gap reaches 17.83 points on ISCXVPN and 4.26 points on USTC-TFC when all packets are used. E. Modern Models under Entity-Disjoint Splits Table III compares Flow-Random and initiator-disjoint evaluation using each model’s corresponding input setting. For

Test-only

Matched

Residual gap

Remap (P ) Zero (Z)

82.4

5.4 4.3

33.0 35.3

49.4 47.1

YaTCb

Remap (P ) Zero (Z)

99.4

89.0 88.4

99.4 99.5

0.0 -0.1

NetMambab

Remap (P ) Zero (Z)

99.4

88.2 86.4

99.2 99.4

0.2 0.0

0 1

Original ET-BERTa

5 5

Macro-F1 (%)

Transformation

15 10

∆F1

TABLE IV Effect of test-only and matched IP transformations on Macro-F1.

(b) Packets per flow

ISCXVPN L0 ISCXVPN L3

20

Initiator-disjoint

∆F1 denotes Flow-Random minus initiator-disjoint Macro-F1.

Stab.: importance stability (%); Sens.: field-only split sensitivity, measured from Packet-Random to Parent-flow grouping; Rem.: retrained removal effect.

LinearSVC L0 LinearSVC L3

Model

a b

CSTNET-TLS 1.3, packet-level input. USTC-TFC, first-5-packet flow input.

each seed, the same common class set is used across models, and predictions outside this set are counted as errors. Initiatordisjoint evaluation reduces Macro-F1 by 31.4–55.1 points on ISCXVPN and by about 23–24 points on USTC-TFC across the three models. All paired 95% confidence intervals remain above zero. F. Test-only vs Matched Transformations Table IV compares the original condition with test-only and matched versions of per-flow remapping and IP zeroing. On USTC-TFC, YaTC and NetMamba lose 11–13 MacroF1 points under test-only IP zeroing, but matched training restores performance to approximately the original level. Perflow remapping shows the same pattern. For ET-BERT on CSTNET-TLS1.3, matched zeroing recovers 31.0 points but leaves a 47.1-point gap relative to R → R. Thus, the loss remaining after retraining can differ substantially from the test-only drop. V. D ISCUSSION A. Test-Only Perturbation vs. Matched Preprocessing Test-only and matched transformations answer different evaluation questions. A test-only transformation measures the sensitivity of a fixed trained model to a change in its input representation. Matched preprocessing instead measures the performance achievable when training and testing use the same transformed representation. This distinction changes how perturbation results should be interpreted. For YaTC and NetMamba, most of the loss caused

by test-only IP transformations disappears after matched training, indicating that the test-only drop largely reflects sensitivity to representation mismatch rather than an irrecoverable loss of predictive information. ET-BERT retains a substantially larger residual after matched processing. This residual may arise from information removed by the transformation, incompatibility with the pretrained representation, or both Takeaway 1: A test-only performance drop should not by itself be interpreted as the amount of information contributed by the modified field. B. Implications for ETC Evaluation Our results suggest that an ETC evaluation should specify more than the classifier, dataset, and nominal train–test split. At minimum, the evaluation protocol should report the sample unit and the grouping object used to construct the split, because different choices preserve different relationships between training and test samples. Where relevant, the resulting cross-partition overlap of entities such as hosts, IP pairs, flows or initiators should also be reported rather than inferred from the split name alone. Feature interventions require a similar distinction. When a field is modified only at test time, the observed performance change reflects the response to a test representation different from that used during training. Matched preprocessing provides a complementary measurement by applying the same transformation during training and testing. Takeaway 2: ETC evaluations should report relevant crosspartition sharing and distinguish test-only interventions from matched train–test preprocessing. VI. C ONCLUSION This work examines what encrypted traffic classification benchmarks measure when shortcut features, cross-partition sharing, and train–test preprocessing are varied. Field-level diagnostics show that feature importance and retrained removal need not assign the same role to a field, while fieldonly experiments show that predictive value can change sharply with the partitioning rule. Controlled Source-IP overlap and packets-per-flow experiments further show that shared identities and repeated observations can substantially change measured performance. The train–test transformation experiments reveal a separate source of ambiguity. For YaTC and NetMamba on USTCTFC, matched training recovers nearly all of the 11–13 points Macro-F1 drop caused by test-only IP zeroing. A testonly drop therefore does not measure the performance loss that remains after retraining. ET-BERT retains a substantial residual under matched processing, although this residual may combine information removal with pretraining distribution shift. Reliable ETC evaluation therefore requires more than reporting a classifier and a train–test split. It should specify the sample unit, the grouping object, what remains shared across partitions, and whether feature transformations are applied only at test time or consistently during both training and testing.

R EFERENCES [1] P. Luo, J. Chu, and G. Yang, “Ip packet-level encrypted traffic classification using machine learning with a light weight feature engineering method,” Journal of Information Security and Applications, vol. 75, p. 103519, 2023. [2] S. Roy, T. Shapira, and Y. Shavitt, “Fast and lean encrypted internet traffic classification,” Computer Communications, vol. 186, pp. 166– 173, 2022. [3] Y. Xu, J. Cao, K. Song, Q. Xiang, and G. Cheng, “FastTraffic: A lightweight method for encrypted traffic fast classification,” Computer Networks, vol. 235, p. 109965, 2023. [4] X. Lin, G. Xiong, G. Gou, Z. Li, J. Shi, and J. Yu, “ET-BERT: A contextualized datagram representation with pre-training transformers for encrypted traffic classification,” in Proceedings of the ACM Web Conference 2022, 2022, pp. 633–642. [5] R. Zhao, M. Zhan, X. Deng, Y. Wang, Y. Wang, G. Gui, and Z. Xue, “Yet another traffic classifier: A masked autoencoder based traffic transformer with multi-level flow representation,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 4, 2023, pp. 5420–5427. [6] T. Wang, X. Xie, W. Wang, C. Wang, Y. Zhao, and Y. Cui, “NetMamba: Efficient network traffic classification via pre-training unidirectional mamba,” in 32nd IEEE International Conference on Network Protocols (ICNP). IEEE, 2024, pp. 1–11. [7] R. Geirhos, J.-H. Jacobsen, C. Michaelis, R. Zemel, W. Brendel, M. Bethge, and F. A. Wichmann, “Shortcut learning in deep neural networks,” Nature Machine Intelligence, vol. 2, no. 11, pp. 665–673, 2020. [8] Y. Zhao, G. Dettori, M. Boffa, L. Vassio, and M. Mellia, “The sweet danger of sugar: Debunking representation learning for encrypted traffic classification,” in Proceedings of the ACM SIGCOMM 2025 Conference, 2025. [9] D. Arp, E. Quiring, F. Pendlebury, A. Warnecke, F. Pierazzi, C. Wressnegger, L. Cavallaro, and K. Rieck, “Dos and don’ts of machine learning in computer security,” in 31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 3971–3988. [10] S. Rezaei and X. Liu, “Deep learning for encrypted traffic classification: An overview,” IEEE Communications Magazine, vol. 57, no. 5, pp. 76– 81, 2019. [11] N. Wickramasinghe, A. Shaghaghi, G. Tsudik, and S. Jha, “SoK: Decoding the enigma of encrypted network traffic classifiers,” in 2025 IEEE Symposium on Security and Privacy (SP). IEEE, 2025, pp. 1825–1843. [12] F. Pendlebury, F. Pierazzi, R. Jordaney, J. Kinder, and L. Cavallaro, “TESSERACT: Eliminating experimental bias in malware classification across space and time,” in 28th USENIX Security Symposium (USENIX Security 19), 2019, pp. 729–746. [13] R. Flood, G. Engelen, D. Aspinall, and L. Desmet, “Bad design smells in benchmark NIDS datasets,” in 2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P). IEEE, 2024, pp. 658–675. [14] C. Wang, X. Xie, T. Wang, and Y. Cui, “Bias in the shadows: Explore shortcuts in encrypted network traffic classification,” in 2026 IEEE/ACM 34th International Symposium on Quality of Service (IWQoS). IEEE, 2026, pp. 1–6. [15] C. Lin, W. Zhang, M. Shen, Y. Jiang, T. Zuo, H. Luo, Y. Wang, X. Meng, and Y. Zhang, “Is the data really noisy? rethinking traffic filtering for encrypted traffic classification,” IEEE Transactions on Dependable and Secure Computing, 2026. [16] G. Draper-Gil, A. H. Lashkari, M. S. I. Mamun, and A. A. Ghorbani, “Characterization of encrypted and VPN traffic using time-related features,” in Proceedings of the 2nd international conference on information systems security and privacy (ICISSP), 2016, pp. 407–414. [17] W. Wang, M. Zhu, X. Zeng, X. Ye, and Y. Sheng, “Malware traffic classification using convolutional neural network for representation learning,” in 2017 International Conference on Information Networking (ICOIN). IEEE, 2017, pp. 712–717.

Related documents

• Shortcut in Generalization: Rethinking Evaluation Protocol for Encrypted Traffic Classification#1343160
• BGP-4 Protocol Analysis#133630
• Traffic Flow Measurement: Architecture#133830
• BGP Protocol Analysis#144394
• Learning Efficient Classification Procedures and Application to Chess End Games#478205