NTC-IQ
Menu

ACM Web Conference 2025

Less is More: Simplifying Network Traffic Classification Leveraging RFCs

Nimesha Wickramasinghe, Arash Shaghaghi, Elena Ferrari, and Sanjay Jha

  • NetMatrix
  • LiM
  • XGBoost
  • RFC-aligned features
View in ACM Digital Library Read open preprint
Research question Can a compact, protocol-aware representation rival deep learning based traffic classifiers?
Method Combine three RFC-aligned attributes in NetMatrix with a vanilla XGBoost classifier.
Evaluation Compare accuracy, inference throughput, latency, memory, and energy against selected baselines.
Outcome 94.2% accuracy and more than 86,000 inferences per second on CSTNET-TLS1.3.

Paper summary

Abstract

LiM is a lightweight methodology for encrypted network traffic classification. It replaces resource-intensive text and image transformations with NetMatrix, a compact tabular representation built from three meaningful, RFC-aligned attributes, then pairs that representation with a vanilla XGBoost classifier.

Results at a glance

30 bytes per session

NetMatrix represents a traffic session using only packet length, time-to-live, and inter-arrival time.

94.2% accuracy

LiM approaches YaTC at 96.3% and substantially exceeds the reported ET-BERT result of 56.8% on CSTNET-TLS1.3.

86,000+ inferences per second

The lightweight classifier supports high-throughput use cases without a deep learning inference stack.

Lower resource consumption

Experiments show major reductions in latency, memory use, and energy consumption relative to selected baselines.

How LiM works

LiM treats representation design as the main research problem. Instead of adapting a large model to an arbitrary traffic encoding, the pipeline first identifies a minimal set of protocol-grounded observations and then uses a conventional classifier.

STEP 01

Select packets

Represent a session with a compact sequence rather than padding a large payload view to a fixed size.

STEP 02

Build NetMatrix

Record total length, time-to-live, and inter-arrival time for the selected packets.

STEP 03

Train XGBoost

Use a vanilla tabular classifier without a deep learning feature extraction pipeline.

STEP 04

Measure the whole system

Compare predictive performance together with inference speed, memory, energy, and latency.

What is NetMatrix?

NetMatrix is a minimal tabular representation of a network session. For each selected packet, it records three attributes with clear protocol meaning:

  • Total length from the IP header
  • Time-to-live from the IP header
  • Inter-arrival time between packets

This design intentionally excludes encrypted payload bytes, noisy session-specific identifiers, and transformations into text or images. The resulting representation is compact, easy to process, and grounded in information that remains observable in contemporary encrypted traffic.

Five problems LiM addresses

  1. Encrypted payload patterns should not be treated as meaningful plaintext features under TLS 1.3.
  2. Fixed-size payload representations can obscure useful traffic characteristics.
  3. Session-specific header fields introduce noise and can weaken generalization.
  4. Text and image conversions distort protocol semantics while increasing computational cost.
  5. Handshake dependence fails when handshakes are absent because of session reuse or zero round-trip time behavior.

What the result means

Complexity should be justified by measurable benefit.

LiM does not argue that simple models will always win. It shows that a small representation with stable protocol meaning can provide a strong baseline, and that accuracy should be evaluated alongside the resources required to obtain it.

Research presentation

Watch the research presentation 3 minutes 32 seconds on YouTube

Citation

N. Wickramasinghe, A. Shaghaghi, E. Ferrari, and S. Jha. “Less is More: Simplifying Network Traffic Classification Leveraging RFCs.” Companion Proceedings of the ACM on Web Conference 2025, pages 1398–1401. DOI 10.1145/3701716.3715492.