arXiv Science⌕ Search
Home/Archive/arXiv

arXiv · 2610.37007

From Ethernet to Wi-Fi: Flow Feature Selection and Construction for Traffic Classification

Francisco Rau·Petia Georgieva·Carlos Herranz·Iñaki Val·Joaquin Perez
View original source ↗Read source document ↗Export metadata ↓

Abstract

Flow-based traffic classifiers trained on Ethernet data may lose accuracy when applied to Wi-Fi traffic. This paper proposes a five-stage procedure for selecting and constructing features that enable Wi-Fi flow classification using models trained only on Ethernet data. The procedure removes the transport protocol identifier, examines rate dependence, compares feature distributions and the information each feature provides for the application classes, reduces redundancy, and constructs normalized packet-size and temporal features. Ethernet and Wi-Fi traffic are simulated in ns-3, with Wi-Fi using Best Effort access category. Labelled Wi-Fi data from six development scenarios are used for feature design, while a separate scenario is reserved for final testing. The evaluation compares feature sets, examines threshold sensitivity, and analyses classification errors under different traffic conditions.

Explore related subjects

cs.NIcs.LG

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Francisco Rau, Petia Georgieva, Carlos Herranz, Iñaki Val, Joaquin Perez. 2026-10-27. From Ethernet to Wi-Fi: Flow Feature Selection and Construction for Traffic Classification. https://arxiv.org/abs/2610.37007

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Where to Sample: Rethinking ML-Based Malicious Traffic Detection at Terabit Scale

Machine Learning (ML)-based malicious traffic detectors can identify unseen attacks, including in encrypted traffic, but scaling them to Terabit rates remains challenging. Packet sampling, commonly used to meet processing limits, can discard essential behavioral information and render detection ineffective. We present Peregrine, a hardware-software co-designed architecture built around a simple principle: compute features before sampling. Peregrine updates ML features over all traffic at line rate in a programmable switch, then downsamples the feature records sent to software inference. We instantiate this design with two detectors that impose distinct feature-computation requirements on the switch. Across 84 attack traces from three datasets, we show that approximate features computed over all packets can outperform exact features computed from sampled packets. In our evaluation, Peregrine preserves detection effectiveness while reducing feature-record rates by three orders of magnitude - even where pre-feature sampling causes detection to collapse.

cs.NI↗
arXiv2026

Kom8ndor: An IEEE 802.11bn-Oriented Simulator for Wi-Fi 8 and Beyond

The upcoming IEEE 802.11bn amendment marks a paradigm shift in Wi-Fi, which will pose ambitious performance targets under the paradigm of Ultra-High Reliability (UHR). To understand the implications of such a new technology and to support early research and protocol design for Wi-Fi 8, we present Kom8ndor. This discrete-event network simulator extends the open-source Komondor platform (a simulator validated against ns-3 and other analytical tools) with 802.11bn features. Among the newly added functionalities, we highlight Multi-Access Point Coordination (MAPC)-including Coordinated Time-Division Multiple Access (Co-TDMA), Coordinated Spatial Reuse (Co-SR), and Coordinated Beamforming (Co-BF)-, Non-Primary Channel Access (NPCA), and Dynamic Subband Operation (DSO). Beyond Wi-Fi 8 implementations, Kom8ndor introduces novel functionalities (e.g., a machine learning wrapper for building AI-based protocols) and a modular design to boost the prototyping and research of future Wi-Fi technologies. Kom8ndor is open-source (GNU GPLv3) and available at https://github.com/wn-upf/Komondor.

cs.NI↗
arXiv2026

NetGuise: Adversarial Traffic Generation for Early-Stage Classifier Evasion

Early-stage encrypted traffic classifiers make decisions from only the first few packets of a connection, enabling low-latency classification but raising robustness concerns under realistic traffic morphing. Existing adversarial traffic generation methods often assume complete flows, feature-level perturbations, or iterative runtime feedback, which do not match the constraints of early-stage execution. We present NetGuise, a target-conditioned traffic morphing framework that generates packet-level padding and non-negative delay actions while preserving packet direction, ordering, and packet count and respecting MTU, bandwidth, and latency constraints. We evaluate NetGuise for censorship evasion under two observation interfaces, i) a history-only causal interface for online packet-by-packet execution, ii) and a full-window oracle interface that provides an upper-bound characterization of early-stage morphability. On VANT, NetGuise achieves 33.2% mean targeted evasion under the causal interface versus 82.0% under the oracle interface; on UTMobileNet, the corresponding results are 5.6% and 81.8%. NetGuise outperforms the strongest causal baseline, BAP, on both datasets and, on VANT, reduces bandwidth overhead from 19.80% to 3.02% and generation latency from 37.42 ms/flow to 1.16 ms/flow. Under the oracle interface, it achieves up to 85.7% targeted evasion, retains 43.5% after four rounds of adaptive censor retraining, and maintains 48% under zero-shot cross-environment transfer. Our results show that early-stage classifiers can remain morphable despite high clean accuracy and that robustness evaluation should account for targeted morphability, observation constraints, defender adaptation, and operational network conditions.

cs.NI↗