# NetTiSA: Extended IP Flow with Time-series Features for Universal Bandwidth-constrained High-speed Network Traffic Classification

arXiv: https://arxiv.org/abs/2310.05530 · HTML: https://mlsanity.com/paper/2310.05530/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 89 references that are in the map.
- First posted on arXiv 9 Oct 2023.

## Builds on (most cited first, 7 of 7)

- [Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset](https://mlsanity.com/paper/1811.00701/) (2018)
- [The Theory Behind Overfitting, Cross Validation, Regularization, Bagging, and Boosting: Tutorial](https://mlsanity.com/paper/1905.12787/) (2019)
- [Fine-grained TLS services classification with reject option](https://mlsanity.com/paper/2202.11984/) (2022)
- [Extensible Machine Learning for Encrypted Network Traffic Application Labeling via Uncertainty Quantification](https://mlsanity.com/paper/2205.05628/) (2022)
- [Network Traffic Classification based on Single Flow Time Series Analysis](https://mlsanity.com/paper/2307.13434/) (2023)
- [Efficient Detection of Botnet Traffic by features selection and Decision Trees](https://mlsanity.com/paper/2107.02896/) (2021)
- [Large Scale Measurement on the Adoption of Encrypted DNS](https://mlsanity.com/paper/2107.04436/) (2021)

## Built on by (most cited first, 4 of 4)

- [CESNET-TimeSeries24: Time Series Dataset for Network Traffic Anomaly Detection and Forecasting](https://mlsanity.com/paper/2409.18874/) (2024)
- [When Simple Model Just Works: Is Network Traffic Classification in Crisis?](https://mlsanity.com/paper/2506.08655/) (2025)
- [Drift-Based Dataset Stability Benchmark](https://mlsanity.com/paper/2512.23762/) (2025)
- [CESNET-TimeSeries26: A Multi-Year Network Traffic Time Series Dataset for Annual Seasonality, Concept Drift, and Long-Term Anomaly Detection](https://mlsanity.com/paper/2610.14799/) (2026)

## Abstract (arXiv)

Network traffic monitoring based on IP Flows is a standard monitoring approach that can be deployed to various network infrastructures, even the large IPS-based networks connecting millions of people. Since flow records traditionally contain only limited information (addresses, transport ports, and amount of exchanged data), they are also commonly extended for additional features that enable network traffic analysis with high accuracy. Nevertheless, the flow extensions are often too large or hard to compute, which limits their deployment only to smaller-sized networks. This paper proposes a novel extended IP flow called NetTiSA (Network Time Series Analysed), which is based on the analysis of the time series of packet sizes. By thoroughly testing 25 different network classification tasks, we show the broad applicability and high usability of NetTiSA, which often outperforms the best-performing related works. For practical deployment, we also consider the sizes of flows extended for NetTiSA and evaluate the performance impacts of its computation in the flow exporter. The novel feature set proved universal and deployable to high-speed ISP networks with 100,Gbps lines; thus, it enables accurate and widespread network security protection.