While network traffic analysis (NTA) increasingly requires diverse features across different classification granularities, existing preprocessing tools often suffer from rigid data structures, limited protocol support, or high memory overhead when handling large-scale features. These constraints force researchers to rebuild monitoring pipelines from scratch for novel feature sets. To address these limitations, we propose fpnt, an open-source C++ framework designed for flexible and rapid NTA preprocessing. fpnt allows researchers to define custom traffic granularity levels – including packet, flow, and flowset – and leverages tshark for extensible protocol dissection. By supporting function-based plugins and configurable CSV schemas, the framework facilitates rapid prototyping while ensuring data correctness.Our evaluation shows that fpnt achieves processing speeds comparable to existing preprocessing tools via file-level multiprocessing. Furthermore, through integration with an end-to-end AutoML pipeline, we demonstrate that fpnt can extract complex features which can be used in encrypted application identification. fpnt thus provides an adaptable tool that bridges the gap between raw traffic data and high-performance machine learning workflows.

Secure Real-time Transport Protocol (SRTP) provides end-to-end media confidentiality in Real-Time Communication (RTC) systems. However, since SRTP embeds application-specific semantics into its unencrypted headers and encrypts only the payload, this metadata remains observable—potentially enabling traffic analysis by passive adversaries even under encryption. We investigate whether plaintext SRTP header extensions can enable packet-level service classification in modern RTC deployments. We analyze six popular RTC applications and propose an ML-based classification pipeline that utilizes RTP header extension metadata to identify apps without any payload decryption, achieving a robust F1-macro score of 0.95. Furthermore, we propose and evaluate a lightweight, permutation-based countermeasure.

Recently, QUIC for the secure and faster connections has standardized but it is unclear that QUIC can cope with website fingerprinting (WF), a technique to infer visited websites from network traffic, since most existing efforts targeted TCP-induced traffic. To this end, we propose a novel QUIC WF technique based on Automated Machine Learning (AutoML). In our approach, we revisit traffic features appeared in literature, but relies on an AutoML framework to achieve best practice without manual intervention. Through experiments, we show that our technique outperforms state-of-the-art WF techniques with an F1-score of 99.79% and a 20-precision of 92.60%.

Transport Layer Security (TLS) is a well-known end-to-end encryption protocol for secure communication, and the use of TLS is continuously increasing, which influences that currently most of the Web traffic is delivered through a secure channel. Unfortunately, the use of secure channel for malware is also substantially increasing so that both application layer payload and metadata from unencrypted header fields become unavailable for malicious traffic classification. While several TLS fingerprinting methods, namely JA3 and Mercury, are available, the approaches are more suitable for exact matching than for machine learning-based classification. To deal with this, in this paper, we revisit Markov chain-based fingerprinting from packet length sequences to classify TLS-encrypted malware traffic into malware families. We especially, evaluate Markov chain-based and the existing fingerprinting methods (JA3 and Mercury) with several classifiers including k-nearest neighbor and convolutional neural network. Our results show that our Markov chain-based approach has better performance than other fingerprinting methods with an appropriate classifier.

Physical layer covert channels exploit the characteristics of radio signals to convey secret messages while remaining inconspicuous within wireless channels.With specifically designed modulation schemes, covert channels effectively disguise secret messages as noise.Since the intentionally embedded noise dissipates when the radio signal is decoded as a bitstream, adversaries can maintain a stealthy breach in communication systems.IoT devices, particularly, often utilize vendor-specific firmware and hardware whose security verification is too complex for everyday users.Hence, these devices can easily be compromised to transmit their data to unauthorized adversaries via the covert channels.To this end, we propose a novel countermeasure system, Ghost-Fi Detector, which detects the covert channels reliably and comprehensively.Our attack models reflect a real-world wireless network technology, Wi-Fi, and cover three aspects of its radio signal characteristics including amplitude, phase, and frequency.Since each model induces distinct manifestations in the received signal, there is no dominant universal detection mechanism that detects all the attack models simultaneously.Instead, Ghost-Fi detector consists of six precisely designed complementary defense mechanisms that perform passive radio-frequency analyses.Evaluation results show that Ghost-Fi Detector achieves an average hit rate of 95% with an almost zero false-positive rate for arbitrary Wi-Fi frames.

Recently, a majority of security operations centers (SOCs) have been facing a critical issue of increased adoption of transport layer security (TLS) encryption on the Internet, in network traffic analysis (NTA). To this end, in this survey article, we present existing research on NTA and related areas, primarily focusing on TLS-encrypted traffic to detect and classify malicious traffic with deployment scenarios for SOCs. Security experts in SOCs and researchers in academia can obtain useful information from our survey, as the main focus of our survey is NTA methods applicable to malware detection and family classification. Especially, we have discussed pros and cons of three main deployment models for encrypted NTA: TLS interception, inspection using cryptographic functions, and passive inspection without decryption. In addition, we have discussed the state-of-the-art methods in TLS-encrypted NTA for each component of a machine learning pipeline, typically used in the state-of-the-art methods.

Due to frequency hopping nature of Bluetooth, sniffing Bluetooth traffic with low-cost devices is a challenging problem. To this end, a state-of-the-art low-cost sniffing system employing two cheap Ubertooth devices [1], proposes machine learning-based prediction technique for adaptive frequency hopping (AFH) map by collecting packet statistics and spectrum sensing. In this paper, we revisit the AFH prediction problem. Our intention of this approach is that proposing better way to label data set to train Support Vector Machine (SVM) that could be done without measuring packet rates by visiting all 79 channels. We build a prototype of AFH prediction technique with a Ubertooth and a SVM. Our result shows that high accuracy can be achieved without the packet-based classifier of BlueEar.

Thanks to the frequency hopping nature of Bluetooth, sniffing Bluetooth traffic with low-cost devices has been considered as a challenging problem. To this end, BlueEar, a state-of-the-art low-cost sniffing system with two Bluetooth radios proposes a set of novel machine learning-based subchannel classification techniques for adaptive frequency hopping (AFH) map prediction by collecting packet statistics and spectrum sensing. However, there is no explicit evaluation results on the accuracy of BlueEar’s AFH map prediction. To this end, in this paper, we revisit the spectrum sensing-based classifier, one of the subchannel classification techniques in BlueEar. At first, we build an independent implementation of the spectrum sensing-based classifier with one Ubertooth sniffing radio. Using the implementation, we conduct a subchannel classification experiment with several machine learning classifiers where spectrum features are utilized. Our results show that higher accuracy can be achieved by choosing an appropriate machine learning classifier and training the classifier with actual AFH maps.Our results show that higher accuracy can be achieved by choosing an appropriate machine learning classifier and training the classifier with actual AFH maps.

The last decade has witnessed the ever-increasing deployment of Wi-Fi networks and the explosion of Bluetooth-based applications. As a result, the coexistence of Bluetooth piconets with highly-dense Wi-Fi networks is a common phenomenon currently. Unlike Wi-Fi that conducts carrier sensing before channel access, Bluetooth adopts frequency hopping based on a predefined hop sequence, which inevitably incurs considerable cross-technology interference to Wi-Fi. While the Adaptive Frequency Hopping technique is standardized for interference reduction, it does not perform well in current practice where densely-deployed Wi-Fi networks commonly cover the whole 2.4 GHz unlicensed spectrum. In this context, this article presents BuSAR, a novel approach to account for the coexistence problem between Bluetooth piconets and dense Wi-Fi networks. BuSAR embodies the first work to aim at mitigating the cross-technology interference between Bluetooth and highly-dense Wi-Fi networks in a distributed manner. At the heart of BuSAR lies a subtle technique called Bluetooth slot availability randomization, which exploits the redundancy of erroneous Bluetooth packets for better Bluetooth/Wi-Fi coexistence. With BuSAR adopted, multiple Bluetooth piconets are guaranteed to operate independently and only a lightweight algorithm is needed to be implemented at each Bluetooth device. Both theoretical analysis and experimental results validate the feasibility and superiority of BuSAR.

In parallel with the rapid adoption of transport layer security (TLS), malware has utilized the encrypted communication channel provided by TLS to hinder detection from network traffic. To this end, recent research efforts are directed toward malware detection and malware family classification for TLS-encrypted traffic. However, amongst their feature sets, the proposals to utilize the sequential information of each TLS session has not been properly evaluated, especially in the context of malware family classification. In this context, we propose a systematic framework to evaluate the state-of-the-art malware family classification methods for TLS-encrypted traffic in a controlled environment and discuss the advantages and limitations of the methods comprehensively. In particular, our experimental results for the 10 representations and classifier combinations show that the graph-based representation for the sequential information achieves better performance regardless of the evaluated classification algorithms. With our framework and findings, researchers can design better machine learning based classifiers.

Web prefetching is a key technology to hide network latencies from users. Conventional prefetching methods, however, misconstrue the purpose of user’s browsing behaviors and resulting experience due to their dependence on statistical characteristics or metadata of individual Web applications. In this letter, we propose a predictive prefetching scheme, WebPrefetcher, which utilizes interaction events to decipher user’s genuine intention and context. Our intensive performance analysis results obtained with a real Web browser demonstrate that WebPrefetcher improves user-perceived quality of experience noticeably, outperforming competitive models.

With the wide adoption of TLS, malware's use of TLS is also growing fast. However, fine-grained feature selection in existing approaches is too burdensome. To this end, we propose to visualize TLS-encrypted flow metadata as an image for better malware traffic analysis and classification. We discuss its feasibility and show some preliminary classification results with high accuracy.

The prosperity of IEEE 802.11-based Wi-Fi networks aggravates cross-technology interference to IEEE 802.15.4-enabled ZigBee networks widely deployed to enable various Internet-of-Things applications. To make ZigBee communication reliable and robust even in a dense Wi-Fi environment, taming Wi-Fi interference in ZigBee networks especially from the perspective of physical layer is of paramount importance. In this context, this work takes aim to design a novel Wi-Fi interference-resilient ZigBee decoder called PolarScout, which separates collided ZigBee signal samples out of Wi-Fi interference to bootstrap ZigBee data decoding. Unlike several existing solutions which need clear signal preamble, tremendous signal strength difference between ZigBee and Wi-Fi, and Wi-Fi interference recognition in prior to ZigBee decoding, PolarScout aims at direct ZigBee decoding in a more generic and challenging case where Wi-Fi interference features a wide range of power levels and arises within a ZigBee packet at an arbitrary position. At the heart of PolarScout lies a subtle shell-shaping technique which harnesses a customized sample sequence to smooth the shell of corrupted signal samples. PolarScout then refers to the resulting shell to recover each contaminated ZigBee sample. Experimental results validate the superiority of PolarScout and its resilience to a wide range of Wi-Fi interference types.

In multi-user MIMO (MU-MIMO) systems using zero-forcing beamforming (ZFBF), an Access Point (AP) utilizes downlink channel state information (CSI) to transmit data streams to multiple clients simultaneously. Since private information of clients can be extracted from CSI, leaking CSI to attackers is considered as harmful so that some research efforts suggest to encrypt CSI feedback. However, a recent study shows that an attacker can infer CSI by eavesdropping data streams with known symbols, not the feedback. To this end, we propose CSIstray that intentionally increases the proportion of inter-client interference to suppress CSI leakage while maintaining bit error rates (BERs) at the clients. Simulation results with a 2×2 MU-MIMO scenario show that CSIstray effectively degrades the attack performance with little impact on downlink transmission. We further implement CSIstray on our testbed to validate the proposed mechanism works properly in a room-scale environment as well as in simulation results.

Even though the growing adoption of TLS protocol empowers web traffic to secure privacy, attackers also leverage the TLS to evade from detection, and this makes detecting threats from the encrypted traffic a crucial task. In this paper, we propose an effective encrypted malware traffic detection method that maintains sufficient performance level by periodic updates using machine learning. The proposed method employs incremental algorithms trained by 31 flow features from TLS, HTTP, and DNS. Experimental results show that the incremental Support Vector Machine with Stochastic Gradient Descent algorithm is suitable for the detection method amongst three algorithms, by off-line and on-line accuracy at a low false discovery rate.

Radio-frequency identification (RFID) system, successfully adopted in many industrial applications, suffers from security issues due to the inherent weakness of wireless communication, such as eavesdropping, replay attack, impersonation attack, and traceability issues. A lot of research efforts based on cryptographic primitives have been conducted in a decade, however, most of the existing security protocols depending on cryptosystems are not feasible to be applied due to the minimalist design of passive tags. A lightweight cryptographic authentication is one of the practical solutions, but it has traceability issues from physical layer information. The other approach is to use the properties of the physical layer of RFID systems. However, since the physical-layer characteristics cannot be intentionally updated, they are vulnerable to situations where an adversary actively obtains authentic data for traceability attacks or replay attacks. Therefore, to resist the security threats, we propose Tagora, a cross-layer authentication protocol, which is the first integration work of two-layer approaches that harness the unpredictable properties of tag's collision responses at both the physical and application layers. Our protocol design is composed of a collision recovery algorithm with a random offset scheme and phase encryption in the physical layer, and authentication process based on a challenge-response mechanism in the application layer. We evaluate Tagora in terms of the untraceability and reliability, and also provide security analysis on how Tagora can defend against plausible attacks while meeting security requirements.

Multipath Transmission Control Protocol (MPTCP) is an approach towards high-throughput and efficient load balancing over multiple paths. Each of paths forms a TCP connection with an IP address, and those can be implemented as multiple network interfaces or multiple ports within a network interface. In this paper, we focus on the multiple network interfaces environment. Each network interface with an IP address is called as a subflow. A subflow is a TCP connection which can have a different internet path identified by IP addresses of source and destination network interfaces. To control these multiple subflows, MPTCP supports many options. Specifically, to establish a new subflow, MPTCP uses an ADD_ADDR option. A host sends ADD_ADDR option to inform another host of its IP address, and then, the host receiving ADD_ADDR option tries to establish a subflow at the address of ADD_ADDR option. However, by forging the ADD_ADDR option, an attacker can create a fake subflow that passes through itself and eventually hijack the connection between both end hosts. In a previous study, Hash-based Message Authentication (HMAC) was added to the ADD_ADDR option, preventing it from being forged. Nevertheless, since the keys for generating HMAC can be leaked during three-way handshake, a variant of the ADD_ADDR attack called the persistent ADD_ADDR attack can be possible. To this end, we propose a protocol that can prevent the ADD_ADDR attacks by backward confirmation of the ADD_ADDR option without encryption. The main idea of our proposal is to apply a digital signature scheme for the backward confirmation. We show security analysis for the proposed protocol and compare with the previous studies in terms of time/space overheads.

The ever-increasing deployment of Wi-Fi and ZigBee networks aggravates cross-technology interference (CTI) in the 2.4 GHz unlicensed spectrum. This letter presents a clean-slate technique, DOTA, to combat the CTI and enable ZigBee/Wi-Fi co-transmission. Unlike existing solutions merely handling Wi-Fi-to-ZigBee interference, DOTA accounts for the true sense of CTI wherein ZigBee and Wi-Fi interfere with each other. At the heart of DOTA lies two operations, signal polishing and pulse disambiguation, for decomposing and threading signal samples to recover contaminated ZigBee and Wi-Fi signals. Experiment results validate the feasibility of superiority of DOTA.

Wireless power transfer technique aiming at wireless energy provision has emerged as a prominent solution to the architecture of long-term and self-sustainable wireless systems. Particularly, by integrating this approach with data communication, radio frequency (RF)-powered networks such as radio frequency identification systems have been ubiquitously deployed in recent years and are considered as one of the key components of both the Internet of Things and the Fourth Industrial Revolution. However, the lack of function diversity at end devices makes the conventional RF-powered networks merely support some simple and dull operations. In this context, various types of new devices with more intelligence and the ability of harvesting wireless power have been designed of late. Unfortunately, inevitable energy loss occurring in wireless propagation usually leads to time-consuming power transfer and network throughput degradation. Bearing this in mind, in this paper, we present a blueprint for the construction of next-generation RF-powered networks which intend to provide flexible network functions, prompt wireless power transfer, and high network throughput. Several relevant challenges and opportunities are also provided as a guidance on the formation of this new architecture-based Internet of Things.

Backscatter networks are widely applied in real world such as inventory management, RFID-enabled passport, and access control. The security issues rapidly grow in its importance with the widespread uses. Especially, if the access control application identifies a user using a message from a backscatter device, the message can be used for tracking or replay attacks. However, most of the existing security protocols depending on cryptosystems cannot be applied into the backscatter networks due to the minimalist design of backscatter devices. In order to alleviate the security menaces, we propose a novel concept of authentication scheme for backscatter networks. Our scheme uses an unpredictable collision by applying our own data structure called Shifted Counting Bloom Filter (SCBF). Based on the SCBF, the scheme can reduce the overhead of backscatter devices required for security. Our performance evaluation shows the information-theoretic secrecy and the reliability of our scheme.