# You Do (Not) Belong Here: Detecting DPI Evasion Attacks with Context Learning

arXiv: https://arxiv.org/abs/2011.01514 · HTML: https://mlsanity.com/paper/2011.01514/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Nov 2020.

## Built on by (most cited first, 5 of 5)

- [Realtime Robust Malicious Traffic Detection via Frequency Domain Analysis](https://mlsanity.com/paper/2106.14707/) (2021)
- [Multi-Expert Adversarial Attack Detection in Person Re-identification Using Context Inconsistency](https://mlsanity.com/paper/2108.09891/) (2021)
- [Pegasus: A Universal Framework for Scalable Deep Learning Inference on the Dataplane](https://mlsanity.com/paper/2506.05779/) (2025)
- [Treat Traffic Like Trees: A Semantic-Preserving Hierarchical Graph-Based Expert Framework for Encrypted Traffic Analysis](https://mlsanity.com/paper/2606.04517/) (2026)
- [LogSHIELD: A Graph-based Real-time Anomaly Detection Framework using Frequency Analysis](https://mlsanity.com/paper/2410.21936/) (2024)

## Abstract (arXiv)

As Deep Packet Inspection (DPI) middleboxes become increasingly popular, a spectrum of adversarial attacks have emerged with the goal of evading such middleboxes. Many of these attacks exploit discrepancies between the middlebox network protocol implementations, and the more rigorous/complete versions implemented at end hosts. These evasion attacks largely involve subtle manipulations of packets to cause different behaviours at DPI and end hosts, to cloak malicious network traffic that is otherwise detectable. With recent automated discovery, it has become prohibitively challenging to manually curate rules for detecting these manipulations. In this work, we propose CLAP, the first fully-automated, unsupervised ML solution to accurately detect and localize DPI evasion attacks. By learning what we call the packet context, which essentially captures inter-relationships across both (1) different packets in a connection; and (2) different header fields within each packet, from benign traffic traces only, CLAP can detect and pinpoint packets that violate the benign packet contexts (which are the ones that are specially crafted for evasion purposes). Our evaluations with 73 state-of-the-art DPI evasion attacks show that CLAP achieves an Area Under the Receiver Operating Characteristic Curve (AUC-ROC) of 0.963, an Equal Error Rate (EER) of only 0.061 in detection, and an accuracy of 94.6% in localization. These results suggest that CLAP can be a promising tool for thwarting DPI evasion attacks.