{"id":"https://openalex.org/W7119509361","doi":"https://doi.org/10.48550/arxiv.2601.04089","title":"Tutorial on Flow-Based Network Traffic Classification Using Machine Learning","display_name":"Tutorial on Flow-Based Network Traffic Classification Using Machine Learning","publication_year":2026,"publication_date":"2026-01-07","ids":{"openalex":"https://openalex.org/W7119509361","doi":"https://doi.org/10.48550/arxiv.2601.04089"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2601.04089","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2601.04089","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2601.04089","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5086869190","display_name":"Adri\u00e1n Pek\u00e1r","orcid":"https://orcid.org/0000-0003-4511-8267"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pekar, Adrian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5122390863","display_name":"Richard Plny","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Plny, Richard","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5120949712","display_name":"Karel Hynek","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hynek, Karel","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9835000038146973,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9835000038146973,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.005400000140070915,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T14258","display_name":"Legal and Policy Issues","score":0.000699999975040555,"subfield":{"id":"https://openalex.org/subfields/3308","display_name":"Law"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/workflow","display_name":"Workflow","score":0.7914000153541565},{"id":"https://openalex.org/keywords/traffic-classification","display_name":"Traffic classification","score":0.7336000204086304},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.6628999710083008},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.595300018787384},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.5891000032424927},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.4893999993801117},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.46860000491142273},{"id":"https://openalex.org/keywords/cover","display_name":"Cover (algebra)","score":0.39959999918937683}],"concepts":[{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.7914000153541565},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7792999744415283},{"id":"https://openalex.org/C169988225","wikidata":"https://www.wikidata.org/wiki/Q7832484","display_name":"Traffic classification","level":3,"score":0.7336000204086304},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.6628999710083008},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.595300018787384},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.5891000032424927},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5514000058174133},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5184999704360962},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.4893999993801117},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.46860000491142273},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4066999852657318},{"id":"https://openalex.org/C2780428219","wikidata":"https://www.wikidata.org/wiki/Q16952335","display_name":"Cover (algebra)","level":2,"score":0.39959999918937683},{"id":"https://openalex.org/C2781317605","wikidata":"https://www.wikidata.org/wiki/Q7832483","display_name":"Traffic analysis","level":2,"score":0.3580999970436096},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.3564999997615814},{"id":"https://openalex.org/C114809511","wikidata":"https://www.wikidata.org/wiki/Q1412924","display_name":"Flow network","level":2,"score":0.34380000829696655},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.34209999442100525},{"id":"https://openalex.org/C207512268","wikidata":"https://www.wikidata.org/wiki/Q3074551","display_name":"Traffic flow (computer networking)","level":2,"score":0.33980000019073486},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.33000001311302185},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.314300000667572},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.314300000667572},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2953999936580658},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.2930000126361847},{"id":"https://openalex.org/C30905978","wikidata":"https://www.wikidata.org/wiki/Q815598","display_name":"Metering mode","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2709999978542328},{"id":"https://openalex.org/C176715033","wikidata":"https://www.wikidata.org/wiki/Q2080768","display_name":"Traffic generation model","level":2,"score":0.26649999618530273}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2601.04089","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2601.04089","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2601.04089","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2601.04089","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Modern":[0],"networks":[1],"carry":[2],"increasingly":[3],"diverse":[4],"and":[5,16,41,47,56,59,74,83,94,125,135],"encrypted":[6],"traffic":[7,30,112,138],"types":[8],"that":[9,69],"demand":[10],"classification":[11,32,68,139],"techniques":[12],"beyond":[13],"traditional":[14],"port-based":[15],"payload-based":[17],"methods.":[18],"This":[19],"tutorial":[20,63],"provides":[21,75],"a":[22],"practical,":[23],"end-to-end":[24],"guide":[25],"to":[26,50,116,133],"building":[27],"machine-learning-based":[28],"network":[29],"flow":[31,39],"systems.":[33],"We":[34],"cover":[35],"the":[36,107],"workflow":[37,109],"from":[38],"metering":[40],"dataset":[42],"creation,":[43],"through":[44],"ground-truth":[45],"labeling":[46],"feature":[48],"engineering,":[49],"leakage-resistant":[51],"experimental":[52],"design,":[53],"model":[54],"training":[55],"evaluation,":[57],"explainability,":[58],"deployment":[60],"considerations.":[61],"The":[62,120],"focuses":[64],"on":[65,78,89,104,110],"supervised":[66],"flow-based":[67],"remains":[70],"effective":[71],"under":[72],"encryption":[73],"actionable":[76],"guidance":[77],"algorithm":[79],"selection,":[80],"performance":[81],"metrics,":[82],"realistic":[84],"partitioning":[85],"strategies,":[86],"with":[87,127],"emphasis":[88],"common":[90],"real-world":[91],"measurement":[92],"artifacts":[93],"methodological":[95],"pitfalls.":[96],"A":[97],"companion":[98],"set":[99],"of":[100],"five":[101],"Jupyter":[102],"notebooks":[103],"GitHub":[105],"implements":[106],"data-to-model":[108],"real":[111],"captures,":[113],"enabling":[114],"readers":[115],"reproduce":[117],"key":[118],"steps.":[119],"intended":[121],"audience":[122],"includes":[123],"researchers":[124],"practitioners":[126],"foundational":[128],"networking":[129],"knowledge":[130],"who":[131],"aim":[132],"design":[134],"deploy":[136],"robust":[137],"systems":[140],"in":[141],"operational":[142],"environments.":[143]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-01-09T00:00:00"}