# Network Traffic Classification based on Single Flow Time Series Analysis

arXiv: https://arxiv.org/abs/2307.13434 · HTML: https://mlsanity.com/paper/2307.13434/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 102 references that are in the map.
- First posted on arXiv 25 Jul 2023.

## Builds on (most cited first, 4 of 4)

- [Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset](https://mlsanity.com/paper/1811.00701/) (2018)
- [Fine-grained TLS services classification with reject option](https://mlsanity.com/paper/2202.11984/) (2022)
- [Extensible Machine Learning for Encrypted Network Traffic Application Labeling via Uncertainty Quantification](https://mlsanity.com/paper/2205.05628/) (2022)
- [Deep Learning for Network Traffic Classification](https://mlsanity.com/paper/2106.12693/) (2021)

## Built on by (most cited first, 3 of 3)

- [NetTiSA: Extended IP Flow with Time-series Features for Universal Bandwidth-constrained High-speed Network Traffic Classification](https://mlsanity.com/paper/2310.05530/) (2023)
- [When Simple Model Just Works: Is Network Traffic Classification in Crisis?](https://mlsanity.com/paper/2506.08655/) (2025)
- [GETA: Generalized Encrypted Traffic Analysis](https://mlsanity.com/paper/2605.31277/) (2026)

## Abstract (arXiv)

Network traffic monitoring using IP flows is used to handle the current challenge of analyzing encrypted network communication. Nevertheless, the packet aggregation into flow records naturally causes information loss; therefore, this paper proposes a novel flow extension for traffic features based on the time series analysis of the Single Flow Time series, i.e., a time series created by the number of bytes in each packet and its timestamp. We propose 69 universal features based on the statistical analysis of data points, time domain analysis, packet distribution within the flow timespan, time series behavior, and frequency domain analysis. We have demonstrated the usability and universality of the proposed feature vector for various network traffic classification tasks using 15 well-known publicly available datasets. Our evaluation shows that the novel feature vector achieves classification performance similar or better than related works on both binary and multiclass classification tasks. In more than half of the evaluated tasks, the classification performance increased by up to 5%.