# Deep Learning and Traffic Classification: Lessons learned from a commercial-grade dataset with hundreds of encrypted and zero-day applications

arXiv: https://arxiv.org/abs/2104.03182 · HTML: https://mlsanity.com/paper/2104.03182/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- Builds on 28 of its 79 references that are in the map.
- First posted on arXiv 7 Apr 2021.

## Builds on (most cited first, 28 of 28)

- [Distilling the Knowledge in a Neural Network](https://mlsanity.com/paper/1503.02531/) (2015)
- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networks](https://mlsanity.com/paper/1610.02136/) (2016)
- [Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI](https://mlsanity.com/paper/1910.10045/) (2019)
- [A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks](https://mlsanity.com/paper/1807.03888/) (2018)
- [Federated Learning: Strategies for Improving Communication Efficiency](https://mlsanity.com/paper/1610.05492/) (2016)
- [ShuffleNet V2: Practical Guidelines for Efficient CNN Architecture Design](https://mlsanity.com/paper/1807.11164/) (2018)
- [Green AI](https://mlsanity.com/paper/1907.10597/) (2019)
- [In-Datacenter Performance Analysis of a Tensor Processing Unit](https://mlsanity.com/paper/1704.04760/) (2017)
- [Towards Open Set Deep Networks](https://mlsanity.com/paper/1511.06233/) (2015)
- [Learning Confidence for Out-of-Distribution Detection in Neural Networks](https://mlsanity.com/paper/1802.04865/) (2018)
- [Joint Unsupervised Learning of Deep Representations and Image Clusters](https://mlsanity.com/paper/1604.03628/) (2016)
- [TensorFlow Lite Micro: Embedded Machine Learning on TinyML Systems](https://mlsanity.com/paper/2010.08678/) (2020)
- [Generative OpenMax for Multi-Class Open Set Classification](https://mlsanity.com/paper/1707.07418/) (2017)
- [Classification-Reconstruction Learning for Open-Set Recognition](https://mlsanity.com/paper/1812.04246/) (2018)
- [Deep Clustering via Joint Convolutional Autoencoder Embedding and Relative Entropy Minimization](https://mlsanity.com/paper/1704.06327/) (2017)
- [Troubling Trends in Machine Learning Scholarship](https://mlsanity.com/paper/1807.03341/) (2018)
- [The Extreme Value Machine](https://mlsanity.com/paper/1506.06112/) (2015)
- [Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning](https://mlsanity.com/paper/1709.02656/) (2017)
- [Clustering with Deep Learning: Taxonomy and New Methods](https://mlsanity.com/paper/1801.07648/) (2018)
- [Learning a Neural-network-based Representation for Open Set Recognition](https://mlsanity.com/paper/1802.04365/) (2018)
- [Deep Learning with Long Short-Term Memory for Time Series Prediction](https://mlsanity.com/paper/1810.10161/) (2018)
- [Know Your Limits: Uncertainty Estimation with ReLU Classifiers Fails at Reliable OOD Detection](https://mlsanity.com/paper/2012.05329/) (2020)
- [Autonomous Unknown-Application Filtering and Labeling for DL-based Traffic Classifier Update](https://mlsanity.com/paper/2002.06359/) (2020)
- [Heterogeneous Data-Aware Federated Learning](https://mlsanity.com/paper/2011.06393/) (2020)
- [Large-scale Mobile App Identification Using Deep Learning](https://mlsanity.com/paper/1910.02350/) (2019)
- [One-vs-Rest Network-based Deep Probability Model for Open Set Recognition](https://mlsanity.com/paper/2004.08067/) (2020)
- [An Overview of Data-Importance Aware Radio Resource Management for Edge Machine Learning](https://mlsanity.com/paper/1911.03878/) (2019)

## Built on by (most cited first, 14 of 14)

- [Fine-grained TLS services classification with reject option](https://mlsanity.com/paper/2202.11984/) (2022)
- [A Lightweight, Efficient and Explainable-by-Design Convolutional Neural Network for Internet Traffic Classification](https://mlsanity.com/paper/2202.05535/) (2022)
- [When a RF Beats a CNN and GRU, Together -- A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification](https://mlsanity.com/paper/2206.08004/) (2022)
- [Many or Few Samples? Comparing Transfer, Contrastive and Meta-Learning in Encrypted Traffic Classification](https://mlsanity.com/paper/2305.12432/) (2023)
- [When Simple Model Just Works: Is Network Traffic Classification in Crisis?](https://mlsanity.com/paper/2506.08655/) (2025)
- [FastFlow: Early Yet Robust Network Flow Classification using the Minimal Number of Time-Series Packets](https://mlsanity.com/paper/2504.02174/) (2025)
- [Accelerating Deep Learning Classification with Error-controlled Approximate-key Caching](https://mlsanity.com/paper/2112.06671/) (2021)
- [AutoML4ETC: Automated Neural Architecture Search for Real-World Encrypted Traffic Classification](https://mlsanity.com/paper/2308.02182/) (2023)
- [DataZoo: Streamlining Traffic Classification Experiments](https://mlsanity.com/paper/2310.19568/) (2023)
- [Non-uniformity is All You Need: Efficient and Timely Encrypted Traffic Classification With ECHO](https://mlsanity.com/paper/2406.01852/) (2024)
- [MERLOT: A Distilled LLM-based Mixture-of-Experts Framework for Scalable Encrypted Traffic Classification](https://mlsanity.com/paper/2411.13004/) (2024)
- [Universal Embedding Function for Traffic Classification via QUIC Domain Recognition Pretraining: A Transfer Learning Success](https://mlsanity.com/paper/2502.12930/) (2025)
- [FedEdge AI-TC: A Semi-supervised Traffic Classification Method based on Trusted Federated Deep Learning for Mobile Edge Computing](https://mlsanity.com/paper/2308.06924/) (2023)
- [Inference-to-complete: A High-performance and Programmable Data-plane Co-processor for Neural-network-driven Traffic Analysis](https://mlsanity.com/paper/2411.00408/) (2024)

## Abstract (arXiv)

The increasing success of Machine Learning (ML) and Deep Learning (DL) has recently re-sparked interest towards traffic classification. While classification of known traffic is a well investigated subject with supervised classification tools (such as ML and DL models) are known to provide satisfactory performance, detection of unknown (or zero-day) traffic is more challenging and typically handled by unsupervised techniques (such as clustering algorithms). In this paper, we share our experience on a commercial-grade DL traffic classification engine that is able to (i) identify known applications from encrypted traffic, as well as (ii) handle unknown zero-day applications. In particular, our contribution for (i) is to perform a thorough assessment of state of the art traffic classifiers in commercial-grade settings comprising few thousands of very fine grained application labels, as opposite to the few tens of classes generally targeted in academic evaluations. Additionally, we contribute to the problem of (ii) detection of zero-day applications by proposing a novel technique, tailored for DL models, that is significantly more accurate and light-weight than the state of the art. Summarizing our main findings, we gather that (i) while ML and DL models are both equally able to provide satisfactory solution for classification of known traffic, however (ii) the non-linear feature extraction process of the DL backbone provides sizeable advantages for the detection of unknown classes.