Network intelligence research
NTC-IQ is a research initiative investigating reliable, privacy-conscious network traffic classification. We test assumptions against modern encrypted protocols, build RFC-aligned representations, and publish reproducible evidence.
Research spanning network security, machine learning, and modern Internet protocols, led at UNSW Sydney with international collaborators.
Selected publications
Each study challenges a different layer of the prevailing network traffic classification pipeline, from datasets and assumptions to representations and models.
Why legacy datasets still dominate recent research, and how TLS 1.3, QUIC, and HTTP/3 invalidate assumptions embedded in older benchmarks.
The field needs living benchmarks aligned with today’s encrypted Internet.
Read the study
A systematization of machine learning based classifiers, their datasets, design choices, assumptions, and recurring causes of overfitting.
Modern encryption exposes methodological weaknesses hidden by headline accuracy.
Read the study
NetMatrix and LiM replace expensive traffic transformations with three meaningful, RFC-aligned attributes and a lightweight classifier.
A 30-byte representation can rival far more complex deep learning pipelines.
Read the studyResearch approach
NTC-IQ starts with what modern networks actually expose, then asks what a classifier can responsibly learn from that evidence.
Evaluate on datasets that reflect TLS 1.3, QUIC, HTTP/3, session reuse, and the protocol behavior of deployed networks.
Choose observable features with clear protocol meaning instead of transformations that distort semantics or rely on unavailable data.
Compare sophisticated models against strong, simple baselines and report the latency, memory, energy, and generalization tradeoffs.
Questions we answer
Direct answers to the questions that motivate the NTC-IQ research program.
Encrypted network traffic classification identifies applications, services, or traffic categories from observable network behavior without decrypting the protected payload. Useful signals can include packet length, timing, direction, and protocol metadata that remains visible.
Older datasets often predate TLS 1.3, QUIC, and HTTP/3 or contain substantial unencrypted traffic. Results built on them may reward features that are absent, encrypted, or unstable in contemporary networks, making deployment performance difficult to predict.
The LiM study shows that they can. A vanilla XGBoost classifier using the compact NetMatrix representation achieved 94.2% accuracy on CSTNET-TLS1.3 while substantially reducing memory, latency, and energy requirements.
RFC-aligned features retain a clear relationship to protocol behavior. This reduces noise, avoids arbitrary conversions into text or images, and makes it easier to explain why a model may generalize across sessions and environments.
Research team
Researchers from UNSW Sydney, the University of California Irvine, and the University of Insubria.
Contact
For research questions, collaboration, dataset enquiries, or feedback on the work, contact the NTC-IQ team.
