# Datasets are not Enough: Challenges in Labeling Network Traffic

arXiv: https://arxiv.org/abs/2110.05977 · HTML: https://mlsanity.com/paper/2110.05977/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Oct 2021.

## Built on by (most cited first, 13 of 13)

- [CESNET-TimeSeries24: Time Series Dataset for Network Traffic Anomaly Detection and Forecasting](https://mlsanity.com/paper/2409.18874/) (2024)
- [LLMcap: Large Language Model for Unsupervised PCAP Failure Detection](https://mlsanity.com/paper/2407.06085/) (2024)
- [Poisoning Network Flow Classifiers](https://mlsanity.com/paper/2306.01655/) (2023)
- [A Comprehensive Survey on Network Traffic Synthesis: From Statistical Models to Deep Learning](https://mlsanity.com/paper/2507.01976/) (2025)
- [EmoPerso: Enhancing Personality Detection with Self-Supervised Emotion-Aware Modelling](https://mlsanity.com/paper/2509.02450/) (2025)
- [What's on My Network? Using Large Language Models to Identify Real-World IoT Devices at Scale](https://mlsanity.com/paper/2510.13817/) (2025)
- [AutoGraphAD: Unsupervised network anomaly detection using Variational Graph Autoencoders](https://mlsanity.com/paper/2511.17113/) (2025)
- [Anomaly Detection Dataset for Industrial Control Systems](https://mlsanity.com/paper/2305.09678/) (2023)
- [HAVANA: Hierarchical stochastic neighbor embedding for Accelerated Video ANnotAtions](https://mlsanity.com/paper/2409.10641/) (2024)
- [Revisiting Network Traffic Analysis: Compatible network flows for ML models](https://mlsanity.com/paper/2511.08345/) (2025)
- [Hybrid Quantum-Classical Autoencoders for Unsupervised Network Intrusion Detection](https://mlsanity.com/paper/2512.05069/) (2025)
- [Drift-Based Dataset Stability Benchmark](https://mlsanity.com/paper/2512.23762/) (2025)
- [Maintaining IoT Device Identification under Concept Drift via Budget-Aware Traffic Labeling](https://mlsanity.com/paper/2608.15465/) (2026)

## Abstract (arXiv)

In contrast to previous surveys, the present work is not focused on reviewing the datasets used in the network security field. The fact is that many of the available public labeled datasets represent the network behavior just for a particular time period. Given the rate of change in malicious behavior and the serious challenge to label, and maintain these datasets, they become quickly obsolete. Therefore, this work is focused on the analysis of current labeling methodologies applied to network-based data. In the field of network security, the process of labeling a representative network traffic dataset is particularly challenging and costly since very specialized knowledge is required to classify network traces. Consequently, most of the current traffic labeling methods are based on the automatic generation of synthetic network traces, which hides many of the essential aspects necessary for a correct differentiation between normal and malicious behavior. Alternatively, a few other methods incorporate non-experts users in the labeling process of real traffic with the help of visual and statistical tools. However, after conducting an in-depth analysis, it seems that all current methods for labeling suffer from fundamental drawbacks regarding the quality, volume, and speed of the resulting dataset. This lack of consistent methods for continuously generating a representative dataset with an accurate and validated methodology must be addressed by the network security research community. Moreover, a consistent label methodology is a fundamental condition for helping in the acceptance of novel detection approaches based on statistical and machine learning techniques.