# Fine-grained TLS services classification with reject option

arXiv: https://arxiv.org/abs/2202.11984 · HTML: https://mlsanity.com/paper/2202.11984/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 29 references that are in the map.
- First posted on arXiv 24 Feb 2022.

## Builds on (most cited first, 14 of 14)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- [On Calibration of Modern Neural Networks](https://mlsanity.com/paper/1706.04599/) (2017)
- [A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networks](https://mlsanity.com/paper/1610.02136/) (2016)
- [Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI](https://mlsanity.com/paper/1910.10045/) (2019)
- [Energy-based Out-of-distribution Detection](https://mlsanity.com/paper/2010.03759/) (2020)
- [Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Images](https://mlsanity.com/paper/1412.1897/) (2014)
- [Gradients as a Measure of Uncertainty in Neural Networks](https://mlsanity.com/paper/2008.08030/) (2020)
- [Deep Learning for Encrypted Traffic Classification: An Overview](https://mlsanity.com/paper/1810.07906/) (2018)
- [How to Achieve High Classification Accuracy with Just a Few Labels: A Semi-supervised Approach Using Sampled Packets](https://mlsanity.com/paper/1812.09761/) (2018)
- [Robust Smartphone App Identification Via Encrypted Network Traffic Analysis](https://mlsanity.com/paper/1704.06099/) (2017)
- [Deep Learning and Traffic Classification: Lessons learned from a commercial-grade dataset with hundreds of encrypted and zero-day applications](https://mlsanity.com/paper/2104.03182/) (2021)
- [Large-scale Mobile App Identification Using Deep Learning](https://mlsanity.com/paper/1910.02350/) (2019)
- [SimLoss: Class Similarities in Cross Entropy](https://mlsanity.com/paper/2003.03182/) (2020)
- [Active Learning for Network Traffic Classification: A Technical Study](https://mlsanity.com/paper/2106.06933/) (2021)

## Built on by (most cited first, 14 of 14)

- [CESNET-TimeSeries24: Time Series Dataset for Network Traffic Anomaly Detection and Forecasting](https://mlsanity.com/paper/2409.18874/) (2024)
- [Survey on Leveraging Uncertainty Estimation Towards Trustworthy Deep Neural Networks: The Case of Reject Option and Post-training Processing](https://mlsanity.com/paper/2304.04906/) (2023)
- [Replication: Contrastive Learning and Data Augmentation in Traffic Classification Using a Flowpic Input Representation](https://mlsanity.com/paper/2309.09733/) (2023)
- [Many or Few Samples? Comparing Transfer, Contrastive and Meta-Learning in Encrypted Traffic Classification](https://mlsanity.com/paper/2305.12432/) (2023)
- [NetTiSA: Extended IP Flow with Time-series Features for Universal Bandwidth-constrained High-speed Network Traffic Classification](https://mlsanity.com/paper/2310.05530/) (2023)
- [When Simple Model Just Works: Is Network Traffic Classification in Crisis?](https://mlsanity.com/paper/2506.08655/) (2025)
- [Network Traffic Classification based on Single Flow Time Series Analysis](https://mlsanity.com/paper/2307.13434/) (2023)
- [Data Augmentation for Traffic Classification](https://mlsanity.com/paper/2401.10754/) (2024)
- [DataZoo: Streamlining Traffic Classification Experiments](https://mlsanity.com/paper/2310.19568/) (2023)
- [Universal Embedding Function for Traffic Classification via QUIC Domain Recognition Pretraining: A Transfer Learning Success](https://mlsanity.com/paper/2502.12930/) (2025)
- [SoK: Where Do Flow Labels Come From? Auditing Label Provenance in Encrypted Traffic Benchmarks](https://mlsanity.com/paper/2609.02140/) (2026)
- [TAO-Net: Two-stage Adaptive OOD Classification Network for Fine-grained Encrypted Traffic Classification](https://mlsanity.com/paper/2512.15753/) (2025)
- [Drift-Based Dataset Stability Benchmark](https://mlsanity.com/paper/2512.23762/) (2025)
- [Unknown-Traffic Detection, Calibration and Shortcut Reliance in Distilled Encrypted-Traffic Classifiers over One Year](https://mlsanity.com/paper/2609.31141/) (2026)

## Abstract (arXiv)

The recent success and proliferation of machine learning and deep learning have provided powerful tools, which are also utilized for encrypted traffic analysis, classification, and threat detection in computer networks. These methods, neural networks in particular, are often complex and require a huge corpus of training data. Therefore, this paper focuses on collecting a large up-to-date dataset with almost 200 fine-grained service labels and 140 million network flows extended with packet-level metadata. The number of flows is three orders of magnitude higher than in other existing public labeled datasets of encrypted traffic. The number of service labels, which is important to make the problem hard and realistic, is four times higher than in the public dataset with the most class labels. The published dataset is intended as a benchmark for identifying services in encrypted traffic. Service identification can be further extended with the task of "rejecting" unknown services, i.e., the traffic not seen during the training phase. Neural networks offer superior performance for tackling this more challenging problem. To showcase the dataset's usefulness, we implemented a neural network with a multi-modal architecture, which is the state-of-the-art approach, and achieved 97.04% classification accuracy and detected 91.94% of unknown services with 5% false positive rate.