Problem
Research questions and friction points this paper is trying to address.
WireGuard
traffic classification
cross-domain evaluation
early-flow fingerprints
matched-view
Matched-View Cross-Domain Evaluation of WireGuard VPN Traffic Classification Using Early-Flow Fingerprints
🤖 AI Summary
本文使用匹配视图方法解决了VPN加密流量分类问题，通过对比不同模型和特征表示法，发现CNN1D处理SPLT指纹效果最佳。
📝 Abstract
Classifying VPN-encrypted traffic by application category typically relies on datasets that collect non-VPN and VPN traffic in separate sessions, conflating encapsulation effects with session-level differences in user behavior, timing, and application mix. We use a recently published WireGuard tunnel dataset in which pre- and post-tunnel traffic is captured simultaneously, with a packet-level match ratio above 99.9%. This matched-capture design eliminates session-level confounds and enables a cross-domain benchmark: models are trained on non-VPN flows and tested on the VPN view of the same underlying flows. We compare whole-flow statistical aggregates (FlowFeatures) and Sequence of Packet Length and Time (SPLT) early-flow fingerprints across Random Forest, XGBoost, and a multi-scale CNN1D. Cross-domain transfer depends jointly on representation and model: tree ensembles achieve balanced accuracy of 0.84-0.93 with FlowFeatures but only 0.60-0.75 with flattened SPLT, whereas CNN1D processes the same SPLT fingerprint as a sequence and achieves the strongest transfer overall (balanced accuracy 0.98, macro F1 0.89) without any VPN data during training.
Innovation
Methods, ideas, or system contributions that make the work stand out.
Matched-View
Cross-Domain Evaluation
Early-Flow Fingerprints
SPLT
CNN1D
🔎 Similar Papers
No similar papers found.
