# Extensible Machine Learning for Encrypted Network Traffic Application Labeling via Uncertainty Quantification

arXiv: https://arxiv.org/abs/2205.05628 · HTML: https://mlsanity.com/paper/2205.05628/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- Builds on 18 of its 89 references that are in the map.
- First posted on arXiv 11 May 2022.

## Builds on (most cited first, 18 of 18)

- [On Calibration of Modern Neural Networks](https://mlsanity.com/paper/1706.04599/) (2017)
- [Simple and Scalable Predictive Uncertainty Estimation using Deep Ensembles](https://mlsanity.com/paper/1612.01474/) (2016)
- [Prototypical Networks for Few-shot Learning](https://mlsanity.com/paper/1703.05175/) (2017)
- [A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networks](https://mlsanity.com/paper/1610.02136/) (2016)
- [A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks](https://mlsanity.com/paper/1807.03888/) (2018)
- [Enhancing The Reliability of Out-of-distribution Image Detection in Neural Networks](https://mlsanity.com/paper/1706.02690/) (2017)
- [Generalized Out-of-Distribution Detection: A Survey](https://mlsanity.com/paper/2110.11334/) (2021)
- [Out-of-Distribution Detection with Deep Nearest Neighbors](https://mlsanity.com/paper/2204.06507/) (2022)
- [Predictive Uncertainty Estimation via Prior Networks](https://mlsanity.com/paper/1802.10501/) (2018)
- [Bayesian Deep Learning and a Probabilistic Perspective of Generalization](https://mlsanity.com/paper/2002.08791/) (2020)
- [A Simple Fix to Mahalanobis Distance for Improving Near-OOD Detection](https://mlsanity.com/paper/2106.09022/) (2021)
- [Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning](https://mlsanity.com/paper/1709.02656/) (2017)
- [Feature Space Singularity for Out-of-Distribution Detection](https://mlsanity.com/paper/2011.14654/) (2020)
- [Automated Website Fingerprinting through Deep Learning](https://mlsanity.com/paper/1708.06376/) (2017)
- [How to Achieve High Classification Accuracy with Just a Few Labels: A Semi-supervised Approach Using Sampled Packets](https://mlsanity.com/paper/1812.09761/) (2018)
- [Var-CNN: A Data-Efficient Website Fingerprinting Attack Based on Deep Learning](https://mlsanity.com/paper/1802.10215/) (2018)
- [Tik-Tok: The Utility of Packet Timing in Website Fingerprinting Attacks](https://mlsanity.com/paper/1902.06421/) (2019)
- [Domain Name Encryption Is Not Enough: Privacy Leakage via IP-based Website Fingerprinting](https://mlsanity.com/paper/2102.08332/) (2021)

## Built on by (most cited first, 9 of 9)

- [NetTiSA: Extended IP Flow with Time-series Features for Universal Bandwidth-constrained High-speed Network Traffic Classification](https://mlsanity.com/paper/2310.05530/) (2023)
- [Network Traffic Classification based on Single Flow Time Series Analysis](https://mlsanity.com/paper/2307.13434/) (2023)
- [FastFlow: Early Yet Robust Network Flow Classification using the Minimal Number of Time-Series Packets](https://mlsanity.com/paper/2504.02174/) (2025)
- [ScatterUQ: Interactive Uncertainty Visualizations for Multiclass Deep Learning Problems](https://mlsanity.com/paper/2308.04588/) (2023)
- [Probabilistic Safety Regions Via Finite Families of Scalable Classifiers](https://mlsanity.com/paper/2309.04627/) (2023)
- [Enhancing Encrypted Internet Traffic Classification Through Advanced Data Augmentation Techniques](https://mlsanity.com/paper/2407.16539/) (2024)
- [TAO-Net: Two-stage Adaptive OOD Classification Network for Fine-grained Encrypted Traffic Classification](https://mlsanity.com/paper/2512.15753/) (2025)
- [Robust and Explainable Divide-and-Conquer Learning for Intrusion Detection](https://mlsanity.com/paper/2605.02015/) (2026)
- [Maintaining IoT Device Identification under Concept Drift via Budget-Aware Traffic Labeling](https://mlsanity.com/paper/2608.15465/) (2026)

## Abstract (arXiv)

With the increasing prevalence of encrypted network traffic, cyber security analysts have been turning to machine learning (ML) techniques to elucidate the traffic on their networks. However, ML models can become stale as new traffic emerges that is outside of the distribution of the training set. In order to reliably adapt in this dynamic environment, ML models must additionally provide contextualized uncertainty quantification to their predictions, which has received little attention in the cyber security domain. Uncertainty quantification is necessary both to signal when the model is uncertain about which class to choose in its label assignment and when the traffic is not likely to belong to any pre-trained classes. We present a new, public dataset of network traffic that includes labeled, Virtual Private Network (VPN)-encrypted network traffic generated by 10 applications and corresponding to 5 application categories. We also present an ML framework that is designed to rapidly train with modest data requirements and provide both calibrated, predictive probabilities as well as an interpretable "out-of-distribution" (OOD) score to flag novel traffic samples. We describe calibrating OOD scores using p-values of the relative Mahalanobis distance. We demonstrate that our framework achieves an F1 score of 0.98 on our dataset and that it can extend to an enterprise network by testing the model: (1) on data from similar applications, (2) on dissimilar application traffic from an existing category, and (3) on application traffic from a new category. The model correctly flags uncertain traffic and, upon retraining, accurately incorporates the new data.