Research
The Split Protocol Decides the Result: Re-Evaluating Encrypted Traffic Classification
This arXiv paper shows that encrypted traffic classifiers can score macro-F1 0.992 under a standard evaluation protocol but only 0.567 when flows from one packet capture are kept on one side of the split. Across five split protocols on backbone QUIC traffic, server-disjoint splitting costs 0.192 macro-F1, while random, temporal and client-disjoint splits are statistically indistinguishable from session-disjoint splitting. The authors propose single-identifier probes as a pre-training diagnostic for identifying the relevant split axis, and report that several pre-registered architectural claims fail under the corrected evaluation.
encrypted traffic classificationevaluation methodologydata leakage