NTC-IQ
Menu

IEEE NCA 2025

Congested by the Past: The Dataset Lag in Network Traffic Analysis

Nimesha Wickramasinghe, Sanjay Jha, Gene Tsudik, and Arash Shaghaghi

  • Dataset evaluation
  • TLS 1.3
  • QUIC
  • HTTP/3
View on IEEE Xplore Open DOI
Research question Do recent NTA studies evaluate classifiers on traffic that reflects modern protocols?
Method Review recent papers, trace their datasets, and compare collection dates with protocol shifts.
Evidence Studies published in 2024 and 2025 across leading network and security venues.
Conclusion Legacy benchmarks still dominate and modern traces are rarely evaluated on their own.

Paper summary

Abstract

This study examines how recent network traffic analysis research still relies on legacy datasets collected before major protocol shifts including TLS 1.3, QUIC, and HTTP/3. A review of papers published in 2024 and 2025 shows that outdated benchmarks continue to dominate, creating a widening gap between academic evaluation and real network traffic.

Key findings

Dataset lag is systemic

Recent studies continue to rely heavily on datasets collected before 2018, while modern traces are rarely used independently.

Protocols changed the evidence

TLS 1.3, QUIC, and HTTP/3 reduce plaintext exposure and reshape observable features used by traffic classifiers.

Legacy accuracy can mislead

Classifiers can appear effective when their benchmark preserves information that contemporary encrypted traffic no longer exposes.

Benchmarks should be living artifacts

Datasets need clear maintenance, update, retirement, and sharing practices as deployed protocols evolve.

How the study was conducted

The analysis connects the datasets used in recent research to the protocol environment in which those datasets were collected. This makes it possible to distinguish a benchmark that is merely older from one that no longer represents the task being claimed.

STEP 01

Review recent literature

Identify contemporary NTA studies and record the datasets used for evaluation.

STEP 02

Trace dataset provenance

Establish when traffic was captured and what applications, protocols, and encryption conditions it contains.

STEP 03

Map protocol milestones

Compare dataset collection periods with changes including TLS 1.3, QUIC, and HTTP/3.

STEP 04

Assess benchmark fit

Evaluate whether each benchmark can support claims about current encrypted traffic.

Why does dataset age matter?

Network traffic classifiers learn from the signals available in their training data. When a dataset contains older handshakes, deprecated cipher suites, plaintext fields, or protocol behavior that is no longer representative, a model may learn shortcuts that cannot survive deployment.

This is not simply a question of whether a dataset is old. The central question is whether its traffic reflects the protocols, encryption defaults, applications, and collection conditions the classifier will encounter in practice.

Practical implication

A newer model does not compensate for an obsolete benchmark.

Claims about deployment readiness should be supported by traffic captured under contemporary protocol conditions. Without that alignment, improvements may reflect benchmark familiarity rather than progress on the real classification problem.

Research agenda

  1. Re-evaluate existing classifiers on modern public datasets rather than assuming results transfer across protocol generations.
  2. Document collection conditions including protocol versions, encryption settings, capture points, and application behavior.
  3. Retire unsuitable benchmarks when their assumptions no longer match the research question being asked.
  4. Share modern traces responsibly so results can be reproduced and compared under current conditions.

Citation

N. Wickramasinghe, S. Jha, G. Tsudik, and A. Shaghaghi. “Congested by the Past: The Dataset Lag in Network Traffic Analysis.” 2025 23rd International Symposium on Network Computing and Applications, pages 35–38. DOI 10.1109/NCA67271.2025.00018.