From Ethernet to Wi-Fi: Flow Feature Selection and Construction for Traffic Classification

This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible.

From Ethernet to Wi-Fi: Flow Feature Selection and Construction for Traffic Classification Francisco Rau∗† , Petia Georgieva‡ , Carlos Herranz∗ , Iñaki Val∗ and Joaquin Perez† ∗ MaxLinear, Inc., Valencia, Spain † Electronic Engineering Department, Universitat de València, Valencia, Spain

‡ Institute of Electronics and Informatics Eng. of Aveiro (IEETA), University of Aveiro, Portugal

arXiv:2610.37007v1 [cs.NI] 27 Oct 2026

Corresponding author: frau@maxlinear.com Abstract—Flow-based traffic classifiers trained on Ethernet data may lose accuracy when applied to Wi-Fi traffic. This paper proposes a five-stage procedure for selecting and constructing features that enable Wi-Fi flow classification using models trained only on Ethernet data. The procedure removes the transport protocol identifier, examines rate dependence, compares feature distributions and the information each feature provides for the application classes, reduces redundancy, and constructs normalized packet-size and temporal features. Ethernet and Wi-Fi traffic are simulated in ns-3, with Wi-Fi using Best Effort access category. Labelled Wi-Fi data from six development scenarios are used for feature design, while a separate scenario is reserved for final testing. The evaluation compares feature sets, examines threshold sensitivity, and analyses classification errors under different traffic conditions. Index Terms—Traffic classification, feature selection, Ethernet, Wi-Fi, ns-3.

I. I NTRODUCTION The classification of downlink traffic at the Wi-Fi access point (AP) is a critical enabler for delivering high Quality of Service (QoS) in modern wireless networks. Ethernet data is often the preferred choice for building traffic classifiers because it provides a controlled and stable environment. In our previous work we developed a flow-based traffic classifier to identify applications from packet sizes, packet counts, and inter-arrival times in Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) flows, without inspecting packet payloads [1]. However, classifiers trained on Ethernet traffic may lose accuracy when applied to WiFi. Wireless contention and network load can change packet timing and feature distributions, making classification sensitive to differences between training and deployment conditions [2]. Therefore, selecting features that remain informative across both media is important. Since collecting labelled traffic under different congested Wi-Fi conditions in real networks is costly, we use the ns-3 network simulator to study this problem under controlled conditions. Previous studies have addressed traffic classification using different feature selection and representation methods. Moore and Zuev [3] combine a Fast Correlation-Based Filter with Naive Bayes classification. FlowPic [4] represents flows as twodimensional histograms of packet size and arrival time and uses a convolutional neural network. Other studies consider changes in traffic distributions. Rosetta [2] combines TCP-aware augmentation with self-supervised learning for Transport Layer Security (TLS) traffic classification and evaluates Ethernet and Wi-Fi. FG-SAT [5] uses Jensen–Shannon divergence to select attributes that preserve class differences across environments

and learns graph-based flow representations. Yuan et al. [6] use mutual information and Kullback–Leibler divergence to evaluate feature information and stability over time for Tor hidden-service fingerprinting. Their work focuses on temporal changes rather than differences between network media. In this paper, we propose a five-stage procedure to select and construct features for Wi-Fi traffic classification using models trained only on Ethernet data. The procedure examines rate dependence, distribution differences, class information, and feature redundancy before constructing normalized packet-size and temporal features. The initial 29 dimensional feature space is reduced to seven input features representative across both media. Labelled Wi-Fi data from six development scenarios (S1– S6) are used for feature design, based on a classifier trained only with Ethernet data. A separate Wi-Fi scenario (S7), containing all traffic classes is reserved for final evaluation. II. M ETHODOLOGY A. Data Processing Flows are identified by their Internet Protocol (IP) addresses, transport ports, and protocol. For TCP, flow statistics include downlink packets and their corresponding reverse-direction TCP acknowledgments. For UDP, only downlink packets are used. Features are computed from packet metadata in fivesecond windows advanced every second. Packets without IP payload are discarded, while pure TCP acknowledgments are retained because they contain TCP headers even without application data. The AP-side classifier targets only downlink application flows forwarded by the AP of the home basic service set (BSS) 1. Uplink application traffic is excluded. Observed duration is the interval between the first and last packets in a window. The eight classes, common to Ethernet and Wi-Fi, include Voice over Internet Protocol (VoIP) and video streaming using Dynamic Adaptive Streaming over HTTP (DASH). Table I lists the classes, Ethernet training rates, and dataset sizes. B. Feature Selection and Construction The first four stages apply fixed rules to successively reduce the original 29 features obtained in [1] to 28, 16, 12, and 9 features. The fifth stage constructs normalized size and temporal features, ending up with 7 final features. 1) Transport Exclusion: Removing the transport identifier prevents direct use of TCP or UDP identity, leaving 28 candidates.

Rate for training ID

Application (classes)

(Mb/s)

VP VoIP VC Video Conference GM Gaming (Quake 3) VS Video Streaming (DASH) BT Bulk TCP IT IPERF TCP IU IPERF UDP BU Bursty UDP

Ethernet

Wi-Fi

Train Test S1–S6

S7

0.10 3 0.11 20

216 216 216 216

69 69 69 69

1,620 2,160 1,890 1,876

270 270 270 540

10 5–200* 10 10

216 216 216 216

69 69 69 69

742 270 1,080 1,080

270 270 270 270

Total

1,728 552 10,718 2,430

IDs are reused in Table IV; the rates shown are for Ethernet training. * 5, 25, 100, and 200 Mb/s, 54 windows each. Wi-Fi counts include five seeds.

MI ratio (class information retained)

TABLE I C OMMON APPLICATION CLASSES AND DATASET WINDOWS .

1.2

1.0

min_iat max_pkt_size

min_pkt_size

avg_max_pkt_size mean_pkt_size

0.8

max_iat

rms_pkt_size

std_pkt_size

duration

burstiness

switching_ratio

avg_min_pkt_size mean_iat

iat_variance_ratio

std_iat

0.6 directions

0.4 0.05

0.10

0.15

0.20

0.25

0.30

0.35

0.40

KS distance D between media (distribution shift)

2) Rate Dependence: For each feature X, the absolute Pearson correlation is computed between X and the traffic rate within each of the four variable-rate applications: Bursty UDP, IPERF UDP, Video Conference, and IPERF TCP (Section III-A). The rate-dependence score is the largest of the four absolute correlations, s(X) = maxa |ra (X)|. A score near one indicates strong linear dependence on rate in at least one application, rather than discrimination between applications. Undefined correlations from constant features are ignored, and features without a valid score are retained. The other four classes have no controlled rate variation in this analysis. Twelve features are removed with s(X) ≥ 0.97: forward, reverse, and total packet and byte counts; TCP flag count; rate descriptors; and related traffic-intensity and mean-volume descriptors. Using measured throughput or configured rate gives the same twelve exclusions, leaving 16 features. 3) Distribution Shift and Class Information: For feature X and application label Y , the two-sample Kolmogorov–Smirnov (KS) distance [7] is D = sup Fbeth (x) − Fbwifi (x) ,

(1)

x

where Fbeth and Fbwifi are empirical cumulative distribution functions. The distance ranges from 0 to 1 and does not use labels. Mutual information (MI) measures how much information X contains about Y [8]. We estimate MI separately for each medium with a nearest-neighbor estimator [9], [10]. Parameter k = 3 specifies the three nearest samples used to estimate local probability relationships: dI wifi (X; Y ) M MI ratio = , dI eth (X; Y ) M

dI eth (X; Y ) > 0. M

(2)

Fig. 1. Distribution shift and class information for 16 features. Blue: retained; red: removed. Dashed lines show the KS threshold (0.30) and MI-ratio thresholds (0.60 and 1.00). Shaded areas show removal regions.

≥ 1.00 (Fig. 1). This removes avg_min_pkt_size, mean_iat, std_iat, and directions, leaving 12. Here, avg_min_pkt_size is an exponentially weighted moving average of minimum size across consecutive windows of a flow; directions is the forward-packet fraction. 4) Redundancy Reduction: Candidates are considered in increasing D. A feature is removed if its absolute Pearson correlation with a retained feature exceeds 0.98 in Ethernet training. This retains max_pkt_size over avg_max_pkt_size, rms_pkt_size over mean_pkt_size, and max_iat over iat_variance_ratio, leaving nine. The retained features have lower distribution shift. Here, avg_max_pkt_size averages maximum packet size as defined for avg_min_pkt_size; iat_variance_ratio divides inter-arrivaltime (IAT) variance by mean IAT. 5) Feature Construction: We retain rms_pkt_size, max_pkt_size, and switching_ratio and construct four ratio features from the remaining statistics (Table II). TABLE II R ATE - DEPENDENCE SCORES BEFORE AND AFTER FEATURE CONSTRUCTION (s(X) FROM S ECTION II-B2).

Original

Constructed

sorig sconstr

std_pkt_size burstiness max_iat min_iat

min_max_ratio pkt_size_range_r activation_fraction iat_min_ratio

0.673 0.667 0.803 0.803

0.027 0.493 0.803 0.766

A ratio below 1 indicates lower estimated MI on Wi-Fi than on Ethernet, while a ratio above 1 indicates higher MI. Both Both size ratios have lower linear correlation with rate metrics use 1,728 Ethernet training windows, balanced across than their original statistics. We additionally use Spearman eight classes, and 10,718 Wi-Fi windows from S1–S6. These correlation to compare the ranks of each original statistic Wi-Fi scenarios deliberately vary application mixes, offered and its constructed feature, rather than to test dependence loads, and co-channel contention to represent different conges- on rate; this comparison does not determine feature selection. tion conditions. This diversity aims to identify features that For the size ratios, these absolute rank correlations are at least remain informative across a broader range of Wi-Fi operating 0.978 in both media. Here, burstiness is (σs − s̄)/(σs + s̄), conditions. Thus, KS distance and MI ratio reflect differences with σs the packet-size standard deviation. The timing ratios in both traffic composition and network conditions, rather express gaps relative to observed duration or mean gap; than the isolated effect of the transmission medium. We retain activation_fraction is smaller when the longest gap occupies features with MI ratio ≥ 0.60 and either D ≤ 0.30 or MI ratio more of the observed span.

TABLE III F INAL SEVEN DIMENSIONAL FEATURE SPACE .

Feature rms_pkt_size max_pkt_size switching_ratio min_max_ratio pkt_size_range_r activation_fraction iat_min_ratio

Formula p s2 smax n∆s /(N − 1) smin /smax (smax − smin )/s̄ 1 − τmax /T τmin /τ̄

N : packet count; si , ti : packet size and timestamp; τi = ti − ti−1 ; T = tN − P t1 ; n∆s : number of size changes between consecutive packets; s2 = N −1 i s2i . Bars indicate means. Zero denominators are replaced by 10−9 .

Table III defines the seven features. Computing them requires nine statistics: root-mean-square (RMS), maximum, minimum, and mean packet sizes; switching ratio; maximum, minimum, and mean inter-arrival times (IATs); and observed duration. The two means, previously excluded as classifier inputs, supply denominators. Switching ratio measures the fraction of consecutive packets with different sizes; activation_fraction is the fraction of the observed span excluding the longest gap. III. E XPERIMENTAL S ETUP A. Ethernet Datasets The Ethernet data use an uncongested 1 Gb/s ns-3 link. IPERF TCP uses four training rates and is also evaluated without a rate limit. The balanced test set comes from separate captures with different simulation seeds and includes rates absent from training. Rate dependence is assessed with 348 additional Ethernet windows. Of these, 270 vary the rates of Video Conference (six, 3–70 Mb/s), Bursty UDP and IPERF UDP (five each, 5–70 Mb/s), and IPERF TCP (four, measured at 5–197 Mb/s). The other 78 cover Gaming, VoIP, and Video Streaming at fixed rates. For Dynamic Adaptive Streaming over HTTP (DASH), the configured rate describes the video profile; segments are downloaded in bursts. B. Wi-Fi Simulation Scenarios The Wi-Fi simulations use a modified version of ns-3.40 with a privately maintained model of the IEEE 802.11 physical (PHY) and medium access control (MAC) layers. The Wi-Fi links use IEEE 802.11be Extremely High Throughput (EHT) at 5 GHz, a 160 MHz channel, modulation and coding scheme (MCS) 5, one spatial stream, and an 800 ns guard interval. All application flows use the Best Effort (BE) access category. Each simulation lasts 60 s, and applications start at 2 s. Table IV lists the downlink flows and rates using the application IDs in Table I. In S3–S6, BSS 1 carries the listed home-network flows, while a neighboring BSS 2 adds eight UDP uplink flows, each at 70 Mb/s, on the same channel. S7 covers all eight classes with nine downlink flows, each to a separate station. Its Video Conference, VoIP, and Gaming applications also generate uplink traffic (4, 0.10, and 0.11 Mb/s, respectively). Each Wi-Fi scenario uses five simulation seeds (five runs per scenario), giving 30 runs for S1–S6. The AP-side extractor logs candidate statistics by flow and window. The first window covers 2–7 s; each flow is labeled by

its destination station’s application. Across 30 S1–S6 runs, 40 downlink flows yield 10,718 windows, 82 short of the 10,800 maximum (54 per flow per run), because congestion leaves some flows incomplete. S7 follows the same procedure. C. Implementation and Evaluation Protocol For the Extreme Gradient Boosting (XGBoost) classifier [11], hyperparameters are selected by grid search using the initial 29 features and only Ethernet training data. Four-fold crossvalidation is performed using four Ethernet training captures, each generated with a different simulation seed. In each fold, three captures are used for training and one for validation, ensuring that overlapping windows from the same capture are not shared between training and validation. A fifth independent capture is reserved exclusively for Ethernet testing. Hyperparameters are selected based on mean validation accuracy, while macro-F1 is also calculated. The selected settings are 400 boosting rounds, maximum depth six, learning rate 0.08, row and column subsampling of 0.85, reg_alpha = 0.1, and reg_lambda = 1.0. To isolate the effect of feature selection and construction, the same hyperparameters are used to train a separate classifier for each of the six feature sets (29, 28, 16, 12, 9, and 7 inputs), using all Ethernet training windows. The seven-feature model also runs online with the Wi-Fi extractor. For comparison, all six classifiers are evaluated offline on the same logged Wi-Fi simulation windows, without further training. The four evaluation sets are Ethernet training and test, WiFi development (S1–S6), and Wi-Fi test (S7), with counts in Table I. S1–S6 guide feature design but not model training; S7 is excluded from both. Training accuracy measures fit to the training data. For S1–S6, accuracy, class recall, and macro-F1 are calculated from all 10,718 windows pooled across 30 runs. Each window has equal weight, rather than each scenario. This summarizes the combined development scenarios. For the held-out S7 scenario, accuracy is reported as the mean ± sample standard deviation across five runs, each containing 486 windows. Because all five runs contain the same number of windows, mean accuracy equals accuracy over all 2,430 pooled S7 windows; the standard deviation describes variation across runs. S7 class recall and macro-F1 also use pooled windows. Consecutive five-second windows overlap by four seconds and are not independent observations. IV. R ESULTS AND D ISCUSSION A. Effect of the Selection and Construction Stages Fig. 2 shows the accuracy obtained with each successive feature set. We examine the main errors below. Ethernet test accuracy is 99.28% with 29 features and 99.46% with 7 features, reaching its minimum after the rate-dependence filter. Removing protocol (29 to 28 features) leaves S1–S6 accuracy unchanged because the TCP flag count still distinguishes TCP and UDP. With 29 features, 932 Video Streaming windows are classified as IPERF TCP and 266 Bulk TCP windows as Video Streaming; results with 28 features are similar. The rate-dependence filter (28 to 16 features) removes the TCP flag count and lowers accuracy on the Ethernet test set, S1–S6, and S7. In S1–S6, 3,092 Video Conference, IPERF UDP, and Bursty UDP windows are classified as IPERF TCP.

TABLE IV W I -F I SCENARIOS : DOWNLINK FLOW RATES (M B / S ) BY APPLICATION ID FROM TABLE I. Scenario

Network

VP

VC

GM

VS

BT

IT

IU

BU

Flows

Windows

S1 S2 S3 S4 S5 S6

One BSS One BSS Two BSSs* Two BSSs* Two BSSs* Two BSSs*

0.10 0.10 0.10 0.10 0.10 0.10

5, 10 5, 10 5 5 5 5

0.11, 0.11 0.11 0.11 0.11 0.11 0.11

20 20 20 20, 10 20 20

15 15 – – – 15

– unb. – – – –

200, 200 200, 200 – – – –

100 100 – – 300 300

10 10 4 5 5 6

2,699 2,691 1,080 1,350 1,346 1,552

S7

One BSS

0.10

8

0.11

20, 10

50

unb.

20

10

9

2,430

Each value is the rate of one downlink flow; –: none; unb.: unbounded. * BSS 1 is the home network; co-channel BSS 2 contributes eight UDP uplink flows at 70 Mb/s each. Flows: home-network downlink flows per run. Windows: evaluated windows across five simulation seeds. S1–S6 are development scenarios; S7 is the held-out test scenario. 99.92 99.46 98.28

100 99.28

Accuracy (%)

90

88.44

99.28

99.28 95.83

88.52

99.82

88.77 88.77

88.48 88.48

88.38 84.98

80 77.78

70

60

Ethernet training Ethernet test Wi-Fi S1–S6 (development) Wi-Fi S7 (test)

59.48

29

Initial

28

Transport

16

Rate

12

9

Shift + MI Redundancy

7

Ratios

0.8326–0.9712 (chosen: 0.97); KS distance, 0.2690–0.3558 (0.30); MI ratio for D > 0.30, 0.8964–1.1572 (1.00); minimum MI ratio, 0.5144–0.7768 (0.60); and redundancy correlation, 0.9416–0.9914 (0.98). The chosen rate threshold is close to the upper end of its range. For joint threshold variation, we test one representative from each of 4 × 9 × 10 × 5 × 22 = 39,600 regions; all retain the same nine raw features. Results are also unchanged across ten MI-estimator seeds. This establishes stability within the tested ranges, not global optimality. C. Classification Errors on S1–S6 With seven features, 165 IPERF TCP windows and ten Bulk TCP windows are classified as Video Streaming. This reduces IPERF TCP recall to 38.9% (Table V).

Number of features and stage

Fig. 2. Accuracy after each feature selection and construction stage (Section II-B; Ratios: feature construction) on the four evaluation sets of Section III-C. Ethernet training accuracy is 100% at every stage. Where the two Wi-Fi lines overlap, the upper value is S7 and the lower value is S1–S6.

These UDP classes use fixed training rates; IPERF TCP covers four. Higher-rate UDP traffic in S1–S6 and Video Conference traffic in S7 produce shorter mean inter-arrival times within the IPERF TCP training range. The KS and MI criteria (16 to 12 features) remove mean_iat, std_iat, avg_min_pkt_size, and directions, restoring correct classification of these UDP flows. Redundancy reduction (12 to nine features) misclassifies all 540 windows of the 300 Mb/s Bursty UDP flows in S5 and S6 as IPERF UDP. Their constant 1,474-byte packets at 40 µs intervals resemble IPERF UDP rather than the variable sizes and gaps of Bursty UDP training traffic. With 12 features, TreeSHAP [12] identifies mean_pkt_size as the largest contribution toward Bursty UDP. It is removed as redundant with rms_pkt_size in training, yet adding it back restores correct classification. Features that are redundant in Ethernet training may affect Wi-Fi classification differently. Feature construction (nine to seven inputs) retains three direct statistics and introduces four ratio-based features. With this set, Bursty UDP is classified correctly and both Wi-Fi sets achieve their highest accuracy. The remaining errors are examined in Sections IV-C and IV-D. B. Sensitivity to Selection Thresholds The same nine raw features are selected when each threshold is varied separately within the following ranges: rate correlation,

TABLE V R ECALL (%) PER CLASS , ACCURACY, M ACRO -F1 WITH 29 AND 7 FEATURES . S1–S6 Class

S7

29

7

29

7

Bulk TCP IPERF TCP Video Streaming Other five classes

63.1 93.0 49.8 100

98.2 38.9 99.7 100

0.0 99.3 98.3 100

100 99.3 100 100

Accuracy Macro-F1

88.48 98.28 88.44 ± 0.27 99.92 ± 0.18 0.840 0.937 0.831 0.999

Other five classes: VoIP, Video Conference, Gaming, IPERF UDP, and Bursty UDP. S1–S6: pooled metrics over 30 runs. S7: accuracy mean ± sample standard deviation across five equal-sized runs; its mean equals pooled accuracy. Class recall and macro-F1 use pooled windows.

For models using 29 to 12 features, TreeSHAP identifies observed duration as one of the two inputs most strongly favoring IPERF TCP. In Ethernet training, IPERF TCP windows span five seconds, while Video Streaming windows are shorter. On Wi-Fi, most windows of both classes span nearly five seconds. With these feature sets, about half of the Video Streaming windows are classified as IPERF TCP. With seven features, nearly all Video Streaming windows are classified correctly, but many IPERF TCP windows are classified as Video Streaming. Because S1–S6 contain about seven times more Video Streaming windows than IPERF TCP windows, overall accuracy increases despite the lower IPERF TCP recall. In S2, IPERF TCP and Video Streaming have similar packet sizes, making them harder to distinguish. In Ethernet training, IPERF TCP sends continuously (activation_fraction

≥ 0.9996), while Video Streaming alternates downloads and about 99.5%. Our conclusion is that careful feature selection idle periods (≤ 0.68). High load introduces longer IPERF and construction can help Ethernet-trained models transfer to TCP gaps while making Video Streaming more continuous. Wi-Fi without using Wi-Fi data for classifier training. Future Their timing becomes less distinct, and almost all IPERF TCP work will evaluate whether the selected features remain suitable windows with activation_fraction below 0.98 are classified under different traffic loads, streaming implementations, and as Video Streaming. real network conditions. D. Results on Test Scenario S7 IPERF TCP is unbounded in S2 and S7, but S7’s lower competing load allows higher throughput and shorter AP delay (Table VI). Only two S7 windows are misclassified, both as Video Streaming. They are the first two IPERF TCP windows of one run and include a startup pause that lowers activation_fraction below 0.98.

ACKNOWLEDGMENT This work was supported by the EU Horizon Europe Program in the frame of Marie Skłodowska-Curie Actions Doctoral Networks (MSCA-DN) project OWIN6G (Optical and wireless sensors networks for 6G scenarios) under Agreement No. 101119624.

TABLE VI T RAFFIC CONDITIONS IN S2 AND S7, AND IPERF TCP RECALL WITH SEVEN FEATURES .

[1] F. Rau, C. Herranz, I. Val, P. Georgieva, and J. Perez, “A novel flow-based online network traffic classification using machine learning,” TechRxiv, preprint, 2025, doi: 10.36227/techrxiv.175459507.75164419/v1. [2] R. Xie, J. Cao, E. Dong, M. Xu, K. Sun, Q. Li, L. Shen, and M. Zhang, “Rosetta: Enabling robust TLS encrypted traffic classification in diverse network environments with TCP-aware traffic augmentation,” in Proc. 32nd USENIX Security Symposium, 2023, pp. 625–642. [3] A. W. Moore and D. Zuev, “Internet traffic classification using Bayesian analysis techniques,” in Proc. ACM SIGMETRICS, 2005, pp. 50–60, doi: 10.1145/1064212.1064220. [4] T. Shapira and Y. Shavitt, “FlowPic: A generic representation for encrypted traffic classification and applications identification,” IEEE Transactions on Network and Service Management, vol. 18, no. 2, pp. 1218–1232, 2021, doi: 10.1109/TNSM.2021.3071441. [5] S. Cui, X. Han, D. Han, Z. Wang, W. Wang, B. Jiang, B. Liu, and Z. Lu, “FG-SAT: Efficient flow graph for encrypted traffic classification under environment shifts,” IEEE Transactions on Information Forensics and Security, vol. 20, pp. 5326–5339, 2025, doi: 10.1109/TIFS.2025.3571663. [6] X. Yuan, Z. Yi, J. Zhang, and H. Zhang, “On the resilience of traffic features under concept drift in hidden service fingerprinting,” Computers, Materials & Continua, vol. 88, no. 3, 2026, art. no. 20, doi: 10.32604/ cmc.2026.072275. [7] N. Smirnov, “Table for estimating the goodness of fit of empirical distributions,” The Annals of Mathematical Statistics, vol. 19, no. 2, pp. 279–281, 1948, doi: 10.1214/aoms/1177730256. [8] Y. Polyanskiy and Y. Wu, Information Theory: From Coding to Learning. Cambridge University Press, 2025, doi: 10.1017/9781108966351. [9] A. Kraskov, H. Stögbauer, and P. Grassberger, “Estimating mutual information,” Physical Review E, vol. 69, no. 6, p. 066138, 2004, doi: 10.1103/PhysRevE.69.066138. [10] B. C. Ross, “Mutual information between discrete and continuous data sets,” PLoS ONE, vol. 9, no. 2, p. e87357, 2014, doi: 10.1371/journal. pone.0087357. [11] T. Chen and C. Guestrin, “XGBoost: A scalable tree boosting system,” in Proc. ACM SIGKDD, 2016, pp. 785–794, doi: 10.1145/2939672.2939785. [12] S. M. Lundberg, G. Erion, H. Chen, A. DeGrave, J. M. Prutkin, B. Nair, R. Katz, J. Himmelfarb, N. Bansal, and S.-I. Lee, “From local explanations to global understanding with explainable AI for trees,” Nature Machine Intelligence, vol. 2, no. 1, pp. 56–67, 2020, doi: 10.1038/s42256-019-0138-9. [13] A. Rao, A. Legout, Y.-S. Lim, D. Towsley, C. Barakat, and W. Dabbous, “Network characteristics of video streaming traffic,” in Proc. ACM CoNEXT, 2011, pp. 1–12, doi: 10.1145/2079296.2079321. [14] S. Akhshabi, A. C. Begen, and C. Dovrolis, “An experimental evaluation of rate-adaptation algorithms in adaptive streaming over HTTP,” in Proc. ACM Multimedia Systems Conf. (MMSys), 2011, pp. 157–168, doi: 10.1145/1943552.1943574. [15] F. Loh, F. Poignée, F. Wamser, F. Leidinger, and T. Hoßfeld, “Uplink vs. downlink: Machine learning-based quality prediction for HTTP adaptive video streaming,” Sensors, vol. 21, no. 12, p. 4172, 2021, doi: 10.3390/ s21124172. [16] P. Juluri, V. Tamarapalli, and D. Medhi, “QoE management in DASH systems using the segment aware rate adaptation algorithm,” in Proc. IEEE/IFIP NOMS, 2016, pp. 129–136, doi: 10.1109/NOMS.2016. 7502805. [17] A. Biernacki, “Interpretable identification of dynamic adaptive streaming over HTTP (DASH) flows based on feature engineering,” Applied Sciences, vol. 15, no. 5, p. 2253, 2025, doi: 10.3390/app15052253.

S2 Downlink load requested by the other flows (Mb/s) IPERF TCP throughput (Mb/s) Mean downlink delay of IPERF TCP at the AP (ms) IPERF TCP windows with activation_fraction < 0.98 Median activation_fraction of Video Streaming IPERF TCP recall (%)

S7

≈550 ≈120 12 197 147 8 63% 0.7% 0.97 0.72 38.9 99.3

In S2, the AP delivers about 370 Mb/s in total. In Ethernet training, the median activation_fraction of Video Streaming is 0.64.

With 29 features, all 270 Bulk TCP windows are classified as IPERF TCP. The higher Bulk TCP rate places its rate-dependent features within the IPERF TCP training range. Removing them is insufficient: most errors persist with 16, 12, and nine features. The longest gap in a Bulk TCP window decreases from 1.2 ms in training to 0.24 ms in S7, close to the IPERF TCP training value of 0.22 ms. TreeSHAP identifies duration, max_iat, and std_pkt_size among the inputs favoring IPERF TCP. Seven features classify all Bulk TCP windows correctly. Its maximum packet size remains 1,475 bytes, compared with at most 592 bytes for IPERF TCP and Video Streaming. Contributions from max_pkt_size, min_max_ratio, and switching_ratio outweigh activation_fraction, which still favors IPERF TCP. The nine-feature model already includes the same size statistics but still misclassifies most Bulk TCP windows. Among the evaluated models, all these windows are classified correctly only after feature construction. Adaptive video traffic can alternate downloads and idle periods, use separate audio and video chunks, and vary segment size and bitrate [13]–[17]. These choices affect packet timing with load and playback state. Our evaluation uses one simulated DASH client and specific traffic generators, limiting generalization to other implementations and conditions. V. C ONCLUSION Our study shows that traffic classifiers trained only on Ethernet data can achieve high classification accuracy on Wi-Fi through careful feature selection and construction. We propose a procedure to reduce the large initial feature set to a compact set of seven flow features that capture packet-size and timing patterns while avoiding features that depend too strongly on traffic rate or differ sharply between Ethernet and Wi-Fi. In the ns-3 simulations, this compact feature space improved accuracy on the held-out Wi-Fi scenario (S7) from about 88% to about 99.9%, while Ethernet accuracy remained high at

R EFERENCES

Related documents

• From Ethernet to Wi-Fi: Flow Feature Selection and Construction for Traffic Classification#1468611
• NIST SP 1800-39 ipd: Data Classification Practices#2847
• Curv-Tail: Lightweight Long-Tailed Encrypted Traffic Classification with Discrete Packet-Length Encoding and Lorentz Prototypes#1116573
• Inference-Time Prior Adaptation for Imbalanced Data Streams under Concept Drift#1455607
• An efficient method for network traffic anomaly detection based on SHAP and deep learning.#610543