Internet Traffic Analysis and Secure E-voting

Latest papers

• A Large-Scale Benchmark and Risk Assessment of Traffic Analysis Attacks on Cloud LLM Services

  Shahrooz Pouryousef, Jesus Lopez, Saeefa Rubaiyat Nowmi, Md Mahmuduzzaman Kamol, Moinul Hossain, Muoi Tran, Mohammad Saidur Rahman · 29 September 2026

  Cloud-based Large language model (LLM) services create a network-level traffic side channel that can expose model, prompt, and task behavior despite encryption. From packet sizes, directions, timing, and burst structure alone, a passive local observer can infer the serving model, the user's prompt c…

• Unknown-Traffic Detection, Calibration and Shortcut Reliance in Distilled Encrypted-Traffic Classifiers over One Year

  Mahmoud Abbasi · 28 September 2026

  Knowledge distillation is the standard way to compress encrypted-traffic classifiers for the edge, and almost all such work judges students by accuracy alone. We ask what else a student inherits: unknown-traffic detection, calibration, shortcut reliance, and whether any survives a year of drift. Res…

• FlowAtom: Atom-Based Evidence Aggregation for Multi-Label Website Fingerprinting

  Chongru Fan, Wentao Huang, Wei Wang, Zhenquan Ding, Jinqiao Shi, Wei Cai, Zhiyu Hao · 25 September 2026

  Identifying the set of monitored websites in mixed encrypted traffic is challenging because an individual flow often provides only partial evidence of website identity. To address this challenge, we propose FlowAtom, which constructs shared prototypes, called Atoms, from flow representations without…

• Feature Suppression and Differential Privacy for Residential Traffic Classification: A Two-Home Federated Study

  M\'arton P\'al Lipcsey-Magyar, Adrian Pekar · 22 September 2026

  Residential traffic classification supports service management, but learning across homes must account for heterogeneous traffic and privacy constraints. Privacy-aware training may impose uneven costs across traffic categories. We study this tradeoff in simulated two-client federated learning using …

• Beyond Measurement Metrics: A Human-Centered Framework for Semantic Validation of Network Traffic Classification

  Igor Cherepanov, David Sessler, Alex Ulmer, Thorsten May, J\"orn Kohlhammer · 16 September 2026

  Machine learning (ML) has become the dominant approach for network traffic classification, achieving very high predictive performance. However, a model is only valuable if it learns semantically meaningful and trustworthy patterns rather than exploiting spurious correlations. Conventional evaluation…

• TDDM-Melatt: A Decoupled Memory and Diffusion Framework for Generalizable Encrypted Traffic Classification

  Ze Chen, Qiming Yu, Zijia Song, Guozheng Yang, Wei Yan · 14 September 2026

  The widespread adoption of encrypted traffic poses severe challenges to current security situational awareness systems based on network traffic monitoring. In existing dataset-driven training and testing studies, limitations such as shortcut learning induced by spurious feature correlations and samp…

• ResLearn-XR: Residual Learning for Network Traffic and Quality-of-Experience-Aware Modeling in Extended Reality

  Yoga Suhas Kuruba Manjunath, Jie Gao, Lian Zhao · 7 September 2026

  We present ResLearn-XR, a residual learning framework for predicting eXtended Reality (XR) network traffic and estimating Quality-of-Experience (QoE) risk. ResLearn-XR adopts a two-stage temporal learning structure comprising a base sequence prediction model augmented with task-specific residual lea…

• Long-Term Behavioral Evaluation for Trusted Collaborator Selection via Bidirectional Mamba

  Botao Zhu, Xianbin Wang · 27 August 2026

  Effective selection of trustworthy collaborators is crucial to ensuring the successful completion of collaborative tasks, which requires accurate assessments of both long-term device behavior and short-term collaborative dynamics. Consistent device behavior patterns, which are learned from historica…

• Pruned Traffic Trees: Native Semantic Compression with a Protocol-Structured Model Family for Encrypted Traffic Classification

  Yuantu Luo, Jun Tao, Xiangyu Xu, Linxiao Yu, Kangying Li · 25 August 2026

  Deep learning has achieved strong performance in encrypted traffic classification (ETC), yet its computational cost limits deployment on resource-constrained network devices such as routers and middleboxes. Existing compression methods mainly operate on weights, channels, hidden representations, or …

• Chameleon: Robust Defense Against Tor Website Fingerprinting via Many-to-Many Traffic Morphing

  Yuwen Cui, Kai Wei, Kehan Shen, Ning Wang, Zhuo Lu, Yao Liu, Guangjing Wang · 21 August 2026

  Website fingerprinting (WF) attacks can infer users' browsing activities from encrypted Tor traffic by exploiting side-channel features. Although many WF defenses have been proposed, we find that most existing defenses create learnable web trace mapping features. We further show that robustness agai…

• PERO: Efficient Robust Post-Training Foundation Models for Encrypted Traffic Classification

  Wumei Du, Jiarong Wen, Kaiyu Zhang, Zi Yang, Yiqin Lv, Longfei Zhang, Dong Liang, Zheng Xie · 18 August 2026

  Encrypted traffic classification is vital for network security, yet real-world deployments are inherently sensitive to rare but high-loss errors such as misclassification of malicious traffic. The encrypted traffic foundation model, as a promising general-purpose technique, can achieve impressive ov…

• BGA: A noise-immune neural distillation framework for malicious signature extraction in high-entropy encrypted flows

  Sheng Hong, Yixuan Huang, Weiwei Jiang, Junyuan Zhang, Jiacheng Wang, Ruijian Jiao · 17 August 2026

  To mitigate attention dilution in high-entropy TLS 1.3 flows, we propose BGA, a noise-immune neural distillation framework for encrypted threat intelligence.The methodology first employs Analysis of Variance (ANOVA) to decouple high-discriminatory control-plane features - specifically industrial set…

• CipherSight: Robust Website Fingerprinting via Record-Resource Semantic Supervision under Distribution Shifts

  Runhan Song, Qiqi Liu, Chuanzhou Pan, Zhenquan Ding, Youquan Xian, Chongru Fan, Lei Cui, Wei Wang, Zhiyu Hao · 17 August 2026

  HTTPS website fingerprinting (WF) aims to identify visited websites from metadata observable in encrypted traffic. However, real-world deployments introduce a significant out-of-distribution (OOD) problem caused by temporal and geographic changes, while previously unseen websites are common in open-…

• Interactive Analysis of Global Explanations using Aggregated Class Activation Maps for Network Data

  Igor Cherepanov, David Sessler, Alex Ulmer, Felix Wagner, Throsten May, J\"orn Kohlhammer · 17 August 2026

  Recent machine learning (ML) advances have demonstrated that deep learning (DL) achieves impressive results in different application domains, including the classification of computer network traffic to corresponding applications. However, the data frequently contains diverging patterns within a sing…

• Robust and Secure Code Watermarking for Large Language Models via ML/Crypto Codesign

  Ruisi Zhang, Neusha Javidnia, Nojan Sheybani, Farinaz Koushanfar · 12 August 2026

  This paper introduces RoSeMary, the first-of-its-kind ML/Crypto codesign watermarking framework that regulates LLM-generated code to avoid intellectual property rights violations and inappropriate misuse in software development. High-quality watermarks adhering to the detectability-fidelity-robustne…

• Enhancing Anomaly Resilience in Research Networks: A Large-Scale Forecasting Benchmark for Dynamic Security Baselining

  Mohammad Arafath Uddin Shariff, Byrav Ramamurthy · 7 August 2026

  Research and Education Networks (RENs) serve as critical infrastructure for scientific discovery, yet they face a unique security paradox: their normal traffic patterns which are characterized by massive, bursty "elephant flows" are statistically indistinguishable from volumetric attacks such as DDo…

• Learning Compression Rules for Network Traffic

  Quentin Lampin (Orange Research), \'Eloi Sainte-Beuve (Orange Research, Universit\'e Grenoble Alpes), Louis-Adrien Dufr\`ene (Orange Research), Guillaume Larue (Orange Research), Massih-Reza Amini (Universit\'e Grenoble Alpes) · 6 August 2026

  We study the problem of learning compact rule-based compressors for structured network traffic. Each packet is a record of header fields that are highly redundant within a flow, and a compressor is a small set of rules matching such records and replacing predictable fields with short codes. We cast …

• Communication-Efficient Secure Aggregation in Decentralized Learning

  Sayan Biswas, Anne-Marie Kermarrec, Rafael Pires, Rishi Sharma, Milos Vujasinovic · 3 August 2026

  Decentralized learning (DL) enables participants to collaboratively train models without a central server, yet it faces significant scalability challenges that demand sparsification to reduce the prohibitive communication costs of peer-to-peer exchange. While secure aggregation effectively mitigates…

• PCAP-LM: An LLM-Native Text Representation for TLS Bulk Traffic Analysis

  Xavier Marjou, Lucas Tamic, Ilan Jaffeux-Cheniout · 31 July 2026

  Large language models (LLMs) offer powerful reasoning capabilities for network traffic analysis, but standard capture formats and their textual equivalents are prohibitively verbose, overflowing LLM context windows by two orders of magnitude. We present PCAP-LM, a flow-centric, LLM-native text repre…

• On the Impact of Entropy-based Features

  Iuri Mundstock, Abreu Quevedo, J\'eferson Campos Nobre, Roben C. Lunardi, Thiago L. T. da Silveira, Bruno L. Dalmazo · 20 July 2026

  Network anomaly detection is increasingly challenging due to the growing diversity and variability of traffic patterns, which are not always well captured by traditional statistical features. In this work, we explore the use of entropy as an additional feature to support supervised network traffic c…

• What's on My Network? Using Large Language Models to Identify Real-World IoT Devices at Scale

  Rameen Mahmood, Tousif Ahmed, Sai Teja Peddinti, Danny Yuxing Huang · 9 July 2026

  The growth of IoT devices in shared environments has outpaced our ability to identify them, posing urgent risks to privacy, safety, and accountability. This challenge is especially pronounced in open-world environments, where network traffic metadata is often sparse, noisy, or adversarial. To addres…

• Resilient Liquid Democracy: Mitigating Voting Power Imbalances via Secure Delegation Networks

  Zhuolun Li, Evangelos Pournaras · 3 July 2026

  Liquid democracy promises to improve collective decision-making by allowing voters to vote directly, delegate their voting power to trusted participants, or combine both approaches through fallback mechanisms. However, existing deployments typically rely on transparent delegation, which exposes vote…

• Traffic-CBM: A Structurally Interpretable Multimodal Framework for Encrypted Traffic Classification

  Honglei Jin, Wenshuo Chen, Shaofeng Liang, Haozhe Jia, Runwei Guan, Menshuo Zhao, Shuxu Jin, Songning Lai, Yutao Yue · 30 June 2026

  Encrypted traffic classification has achieved strong performance, but its decision process remains difficult to interpret. Existing methods usually combine flow statistics, packet sequences, and byte-level representations into opaque latent features, making it unclear which type of evidence actually…

• SurrogateShield: Beyond Redaction for High-Utility, Privacy-Preserving LLM Interactions

  Sherwin Vishesh Jathanna · 30 June 2026

  LLM-based assistants transmit user queries verbatim to third-party API endpoints that lie outside the user's audit or control. When those queries contain personally identifiable information (PII), the data persists on remote infrastructure subject to breach, subpoena, or policy change. Placeholder r…

• ML-Powered LDAP Reconnaissance Detection using Weak Supervision

  Shaefer Drew, Edward Raff, Michael Brautbar, Yaron Zinar, Benjamin Malmberg, Dor Agron, Sagi Sheinfeld, Avraham Kama, Asaf Romano · 30 June 2026

  Lightweight Directory Access Protocol (LDAP) is a protocol that allows users to query and modify Active Directory (AD) data. By default, all users have read access to all AD data through LDAP, making it a common initial tool for reconnaissance when a threat actor first compromises an identity. To ca…