# When Simple Model Just Works: Is Network Traffic Classification in Crisis?

arXiv: https://arxiv.org/abs/2506.08655 · HTML: https://mlsanity.com/paper/2506.08655/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 50 references that are in the map.
- First posted on arXiv 10 Jun 2025.

## Builds on (most cited first, 13 of 13)

- [Optuna: A Next-generation Hyperparameter Optimization Framework](https://mlsanity.com/paper/1907.10902/) (2019)
- [Billion-scale similarity search with GPUs](https://mlsanity.com/paper/1702.08734/) (2017)
- [How to Achieve High Classification Accuracy with Just a Few Labels: A Semi-supervised Approach Using Sampled Packets](https://mlsanity.com/paper/1812.09761/) (2018)
- [Deep Learning and Traffic Classification: Lessons learned from a commercial-grade dataset with hundreds of encrypted and zero-day applications](https://mlsanity.com/paper/2104.03182/) (2021)
- [Fine-grained TLS services classification with reject option](https://mlsanity.com/paper/2202.11984/) (2022)
- [CESNET-TimeSeries24: Time Series Dataset for Network Traffic Anomaly Detection and Forecasting](https://mlsanity.com/paper/2409.18874/) (2024)
- [Network Intrusion Datasets: A Survey, Limitations, and Recommendations](https://mlsanity.com/paper/2502.06688/) (2025)
- [A Lightweight, Efficient and Explainable-by-Design Convolutional Neural Network for Internet Traffic Classification](https://mlsanity.com/paper/2202.05535/) (2022)
- [Replication: Contrastive Learning and Data Augmentation in Traffic Classification Using a Flowpic Input Representation](https://mlsanity.com/paper/2309.09733/) (2023)
- [NetTiSA: Extended IP Flow with Time-series Features for Universal Bandwidth-constrained High-speed Network Traffic Classification](https://mlsanity.com/paper/2310.05530/) (2023)
- [Network Traffic Classification based on Single Flow Time Series Analysis](https://mlsanity.com/paper/2307.13434/) (2023)
- [Data Augmentation for Traffic Classification](https://mlsanity.com/paper/2401.10754/) (2024)
- [Universal Embedding Function for Traffic Classification via QUIC Domain Recognition Pretraining: A Transfer Learning Success](https://mlsanity.com/paper/2502.12930/) (2025)

## Built on by (most cited first, 4 of 4)

- [SoK: Where Do Flow Labels Come From? Auditing Label Provenance in Encrypted Traffic Benchmarks](https://mlsanity.com/paper/2609.02140/) (2026)
- [TDDM-Melatt: A Decoupled Memory and Diffusion Framework for Generalizable Encrypted Traffic Classification](https://mlsanity.com/paper/2608.30745/) (2026)
- [Unknown-Traffic Detection, Calibration and Shortcut Reliance in Distilled Encrypted-Traffic Classifiers over One Year](https://mlsanity.com/paper/2609.31141/) (2026)
- [CESNET-TimeSeries26: A Multi-Year Network Traffic Time Series Dataset for Annual Seasonality, Concept Drift, and Long-Term Anomaly Detection](https://mlsanity.com/paper/2610.14799/) (2026)

## Abstract (arXiv)

Machine learning has been applied to network traffic classification (TC) for over two decades. While early efforts used shallow models, the latter 2010s saw a shift toward complex neural networks, often reporting near-perfect accuracy. However, it was recently revealed that a simple k-NN baseline using packet sequences metadata (sizes, times, and directions) can be on par or even outperform more complex methods. In this paper, we investigate this phenomenon further and evaluate this baseline across 12 datasets and 15 TC tasks, and investigate why it performs so well. Our analysis shows that most datasets contain over 50% redundant samples (identical packet sequences), which frequently appear in both training and test sets due to common splitting practices. This redundancy can lead to overestimated model performance and reduce the theoretical maximum accuracy when identical flows have conflicting labels. Given its distinct characteristics, we further argue that standard machine learning practices adapted from domains like NLP or computer vision may be ill-suited for TC. Finally, we propose new directions for task formulation and evaluation to address these challenges and help realign the field.