# Non-uniformity is All You Need: Efficient and Timely Encrypted Traffic Classification With ECHO

arXiv: https://arxiv.org/abs/2406.01852 · HTML: https://mlsanity.com/paper/2406.01852/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 71 references that are in the map.
- First posted on arXiv 3 Jun 2024.

## Builds on (most cited first, 9 of 9)

- [Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning](https://mlsanity.com/paper/1709.02656/) (2017)
- [New Directions in Automated Traffic Analysis](https://mlsanity.com/paper/2008.02695/) (2020)
- [How to Achieve High Classification Accuracy with Just a Few Labels: A Semi-supervised Approach Using Sampled Packets](https://mlsanity.com/paper/1812.09761/) (2018)
- [Deep Learning and Traffic Classification: Lessons learned from a commercial-grade dataset with hundreds of encrypted and zero-day applications](https://mlsanity.com/paper/2104.03182/) (2021)
- [pForest: In-Network Inference with Random Forests](https://mlsanity.com/paper/1909.05680/) (2019)
- [Replication: Contrastive Learning and Data Augmentation in Traffic Classification Using a Flowpic Input Representation](https://mlsanity.com/paper/2309.09733/) (2023)
- [Traffic Refinery: Cost-Aware Data Representation for Machine Learning on Network Traffic](https://mlsanity.com/paper/2010.14605/) (2020)
- [Classification of Encrypted IoT Traffic Despite Padding and Shaping](https://mlsanity.com/paper/2110.11188/) (2021)
- [FlowWise: Stateful Fast-Slow Model Serving for Streaming Traffic Intelligence](https://mlsanity.com/paper/2402.03694/) (2024)

## Built on by (most cited first, 1 of 1)

- [Versatile yet Efficient Network Traffic Analysis: Offloading Network Foundation Model to SmartNIC](https://mlsanity.com/paper/2508.02001/) (2025)

## Abstract (arXiv)

With 95% of Internet traffic now encrypted, an effective approach to classifying this traffic is crucial for network security and management. This paper introduces ECHO -- a novel optimization process for ML/DL-based encrypted traffic classification. ECHO targets both classification time and memory utilization and incorporates two innovative techniques. The first component, HO (Hyperparameter Optimization of binnings), aims at creating efficient traffic representations. While previous research often uses representations that map packet sizes and packet arrival times to fixed-sized bins, we show that non-uniform binnings are significantly more efficient. These non-uniform binnings are derived by employing a hyperparameter optimization algorithm in the training stage. HO significantly improves accuracy given a required representation size, or, equivalently, achieves comparable accuracy using smaller representations. Then, we introduce EC (Early Classification of traffic), which enables faster classification using a cascade of classifiers adapted for different exit times, where classification is based on the level of confidence. EC reduces the average classification latency by up to 90%. Remarkably, this method not only maintains classification accuracy but also, in certain cases, improves it. Using three publicly available datasets, we demonstrate that the combined method, Early Classification with Hyperparameter Optimization (ECHO), leads to a significant improvement in classification efficiency.