mlsanityData to 14 Oct 2026

SoK: Where Do Flow Labels Come From? Auditing Label Provenance in Encrypted Traffic Benchmarks

arXiv 2609.02140 ↗First posted 2 Sep 2026cs.NI cs.LGcited by 1

Not on the map. Why?

Abstract (arXiv)

Encrypted traffic classification infers semantics beyond the flow record from transport-layer observables, and supervised training rests on labels that hold for the individual flow they are attached to. Recent systematizations scrutinize model in- puts and data splits; we systematize the complementary label side. Across 14 audited benchmark entries, we identify two recurring label-side strategies: coarse inheritance, which risks labelling flows the evidence does not cover, and overstrict filtering, which keeps only self-attesting flows and risks dis- carding relevant ones. No audited entry exposes a countable pre-selection population, and the task objects downstream papers attach to the same labels disagree with the recovered record in 8 of 23 referenced cells. Under strict side-channel features we derive a representation-relative ceiling on bal- anced accuracy for any classifier restricted to those features: on the public benchmarks that inherit, it ranges from 0.56 to 0.76. On the filtering side, only 24.95% of connections in our fully captured corpus carry an observable SNI of their own; yet the discarded connections raise macro accuracy from 0.44 to 0.65 through same-run co-occurrence features. We end with recommendations for benchmark builders and users.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 15 of its 53 references that are in the map. First posted on arXiv 2 Sep 2026.

Builds on

15 of 53 references.

References · 15

  1. 2018Datasheets for Datasetscited by 1,386
  2. 2021Pervasive Label Errors in Test Sets Destabilize Machine Learning Benchmarkscited by 395
  3. 2020Dos and Don'ts of Machine Learning in Computer Securitycited by 102
  4. 2022ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classificationcited by 66
  5. 2024NetMamba: Efficient Network Traffic Classification via Pre-training Unidirectional Mambacited by 24
  6. 2025SoK: Decoding the Enigma of Encrypted Network Traffic Classifierscited by 15
  7. 2022Fine-grained TLS services classification with reject optioncited by 14
  8. 2023TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-grained Encrypted Traffic Classificationcited by 13
  9. 2023Low-Quality Training Data Only? A Robust Framework for Detecting Encrypted Malicious Network Trafficcited by 12
  10. 2024Robustifying ML-powered Network Classifiers with PANTScited by 6
  11. 2021A First Look at Class Incremental Learning in Deep Learning Mobile Traffic Classificationcited by 4
  12. 2023Many or Few Samples? Comparing Transfer, Contrastive and Meta-Learning in Encrypted Traffic Classificationcited by 4
3 more
  1. 2025When Simple Model Just Works: Is Network Traffic Classification in Crisis?cited by 4
  2. 2025Taming Volatility: Stable and Private QUIC Classification with Federated Learningcited by 1
  3. 2025Synecdoche: Efficient and Accurate In-Network Traffic Classification via Direct Packet Sequential Pattern Matchingcited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Unknown-Traffic Detection, Calibration and Shortcut Reliance in Distilled Encrypted-Traffic Classifiers over One Yearcited by 0