# CBR -- Boosting Adaptive Classification By Retrieval of Encrypted Network Traffic with Out-of-distribution

arXiv: https://arxiv.org/abs/2403.11206 · HTML: https://mlsanity.com/paper/2403.11206/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 15 of its 69 references that are in the map.
- First posted on arXiv 17 Mar 2024.

## Builds on (most cited first, 15 of 15)

- [Out-of-Distribution Detection with Deep Nearest Neighbors](https://mlsanity.com/paper/2204.06507/) (2022)
- [ANN-Benchmarks: A Benchmarking Tool for Approximate Nearest Neighbor Algorithms](https://mlsanity.com/paper/1807.05614/) (2018)
- [Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection](https://mlsanity.com/paper/1704.08996/) (2017)
- [Deep Learning for Encrypted Traffic Classification: An Overview](https://mlsanity.com/paper/1810.07906/) (2018)
- [How to Achieve High Classification Accuracy with Just a Few Labels: A Semi-supervised Approach Using Sampled Packets](https://mlsanity.com/paper/1812.09761/) (2018)
- [Robust Smartphone App Identification Via Encrypted Network Traffic Analysis](https://mlsanity.com/paper/1704.06099/) (2017)
- [Off the Beaten Path: Let's Replace Term-Based Retrieval with k-NN Search](https://mlsanity.com/paper/1610.10001/) (2016)
- [K-nearest Neighbor Search by Random Projection Forests](https://mlsanity.com/paper/1812.11689/) (2018)
- [DeepMAL -- Deep Learning Models for Malware Traffic Detection and Classification](https://mlsanity.com/paper/2003.04079/) (2020)
- [Packet2Vec: Utilizing Word2Vec for Feature Extraction in Packet Data](https://mlsanity.com/paper/2004.14477/) (2020)
- [freud: A Software Suite for High Throughput Analysis of Particle Simulation Data](https://mlsanity.com/paper/1906.06317/) (2019)
- [CGNN: Traffic Classification with Graph Neural Network](https://mlsanity.com/paper/2110.09726/) (2021)
- [When a RF Beats a CNN and GRU, Together -- A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification](https://mlsanity.com/paper/2206.08004/) (2022)
- [Robust Machine Learning for Encrypted Traffic Classification](https://mlsanity.com/paper/1603.04865/) (2016)
- [An Empirical Study of the Cost of DNS-over-HTTPS](https://mlsanity.com/paper/1909.06192/) (2019)

## Abstract (arXiv)

Encrypted network traffic Classification tackles the problem from different approaches and with different goals. One of the common approaches is using Machine learning or Deep Learning-based solutions on a fixed number of classes, leading to misclassification when an unknown class is given as input. One of the solutions for handling unknown classes is to retrain the model, however, retraining models every time they become obsolete is both resource and time-consuming. Therefore, there is a growing need to allow classification models to detect and adapt to new classes dynamically, without retraining, but instead able to detect new classes using few shots learning [1]. In this paper, we introduce Adaptive Classification By Retrieval CBR, a novel approach for encrypted network traffic classification. Our new approach is based on an ANN-based method, which allows us to effectively identify new and existing classes without retraining the model. The novel approach is simple, yet effective and achieved similar results to RF with up to 5% difference (usually less than that) in the classification tasks while having a slight decrease in the case of new samples (from new classes) without retraining. To summarize, the new method is a real-time classification, which can classify new classes without retraining. Furthermore, our solution can be used as a complementary solution alongside RF or any other machine/deep learning classification method, as an aggregated solution.