Cbr Encrypted Traffic Eval

---
name: cbr-encrypted-traffic-eval
description: Evaluates an ANN-based adaptive classifier's ability to classify encrypted network traffic into known categories such as malware families, operating systems, browsers, and applications. It specifically probes the model's capacity to dynamically adapt to new or out-of-distribution classes without retraining, while measuring any performance degradation on existing classes compared to traditional baselines. Use when the user wants to benchmark on BOA, MTA, or asks about evaluating this task. Reports classification performance.
metadata:
  skill_kind: dataset_eval
  source_arxiv: 2403.11206
  bibtex_key: lukach2024cbr
  confidence: medium
---

# cbr-encrypted-traffic-eval

> CBR -- Boosting Adaptive Classification By Retrieval of Encrypted Network Traffic with Out-of-distribution — Lukach et al. (2024) (arXiv:2403.11206, 2024)

## What this evaluates

Evaluates an ANN-based adaptive classifier's ability to classify encrypted network traffic into known categories such as malware families, operating systems, browsers, and applications. It specifically probes the model's capacity to dynamically adapt to new or out-of-distribution classes without retraining, while measuring any performance degradation on existing classes compared to traditional baselines.

## Datasets

- **BOA** — total 20000; splits: train (-1), test (-1)
- **MTA** — total ?; splits: train (-1), test (-1)

## Metrics

- `classification performance` **(primary)** — range: percent
  - Overall accuracy or F1-score computed over predicted class labels versus ground truth labels. The paper compares this metric against a Random Forest baseline to measure performance degradation when learning new classes.

## Input / output format

**Input**: Encrypted network traffic sessions (PCAPs/flows) described by session duration, forward/backward packet counts, and traffic sizes.

**Output**: Discrete class labels corresponding to malware family, operating system, browser, or application type.

## Scoring recipe

```python
def compute_performance(predictions, gold):
    correct = sum(1 for p, g in zip(predictions, gold) if p == g)
    return correct / len(gold) * 100
```

## Common pitfalls

- Threshold selection for OOD detection significantly impacts adaptation without retraining.
- Direct comparison with Random Forest requires careful handling of the few-shot vs. full-supervised training paradigm.
- Feature extraction from TLS-encrypted flows may vary across implementations, affecting reproducibility.

## Evidence (verbatim from paper)

> The goal of our evaluation was, first to assess the slight decrease in our classifier’s performance due to learning new classes, while classifying existing classes when comparing them to a classical machine learning classifier (e.g., RF). Second, to show the robustness of our ANN-based classifier in the classification of new classes.

## Citation

```bibtex
@misc{lukach2024cbr,
  title={CBR -- Boosting Adaptive Classification By Retrieval of Encrypted Network Traffic with Out-of-distribution},
  author={Lukach et al. (2024)},
  year={2024},
  note={arXiv:2403.11206}
}
```

- arXiv: 2403.11206