# Revisiting Network Traffic Analysis: Compatible network flows for ML models

arXiv: https://arxiv.org/abs/2511.08345 · HTML: https://mlsanity.com/paper/2511.08345/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 20 references that are in the map.
- First posted on arXiv 11 Nov 2025.

## Builds on (most cited first, 9 of 9)

- [Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset](https://mlsanity.com/paper/1811.00701/) (2018)
- [A Survey of Network-based Intrusion Detection Data Sets](https://mlsanity.com/paper/1903.02460/) (2019)
- [Towards a Standard Feature Set for Network Intrusion Detection System Datasets](https://mlsanity.com/paper/2101.11315/) (2021)
- [Datasets are not Enough: Challenges in Labeling Network Traffic](https://mlsanity.com/paper/2110.05977/) (2021)
- [SoK: Realistic Adversarial Attacks and Defenses for Intelligent Network Intrusion Detection](https://mlsanity.com/paper/2308.06819/) (2023)
- [Supervised Feature Selection Techniques in Network Intrusion Detection: a Critical Review](https://mlsanity.com/paper/2104.04958/) (2021)
- [Reliable Feature Selection for Adversarially Robust Cyber-Attack Detection](https://mlsanity.com/paper/2404.04188/) (2024)
- [Efficient Network Traffic Feature Sets for IoT Intrusion Detection](https://mlsanity.com/paper/2406.08042/) (2024)
- [A Novel Approach to Network Traffic Analysis: the HERA tool](https://mlsanity.com/paper/2501.07475/) (2025)

## Abstract (arXiv)

To ensure that Machine Learning (ML) models can perform a robust detection and classification of cyberattacks, it is essential to train them with high-quality datasets with relevant features. However, it can be difficult to accurately represent the complex traffic patterns of an attack, especially in Internet-of-Things (IoT) networks. This paper studies the impact that seemingly similar features created by different network traffic flow exporters can have on the generalization and robustness of ML models. In addition to the original CSV files of the Bot-IoT, IoT-23, and CICIoT23 datasets, the raw network packets of their PCAP files were analysed with the HERA tool, generating new labelled flows and extracting consistent features for new CSV versions. To assess the usefulness of these new flows for intrusion detection, they were compared with the original versions and were used to fine-tune multiple models. Overall, the results indicate that directly analysing and preprocessing PCAP files, instead of just using the commonly available CSV files, enables the computation of more relevant features to train bagging and gradient boosting decision tree ensembles. It is important to continue improving feature extraction and feature selection processes to make different datasets more compatible and enable a trustworthy evaluation and comparison of the ML models used in cybersecurity solutions.