{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T11:07:34Z","timestamp":1772449654849,"version":"3.50.1"},"publisher-location":"Singapore","reference-count":34,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819699131","type":"print"},{"value":"9789819699148","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-981-96-9914-8_13","type":"book-chapter","created":{"date-parts":[[2025,7,16]],"date-time":"2025-07-16T14:23:19Z","timestamp":1752675799000},"page":"149-161","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["MENTOR: Malicious Network Traffic Detection Through Optimized LLM-Based Recognition"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-9655-8593","authenticated-orcid":false,"given":"Junxiang","family":"Jia","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-3392-9832","authenticated-orcid":false,"given":"Haoyang","family":"Meng","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-4485-7337","authenticated-orcid":false,"given":"Yizhong","family":"Hu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3975-5606","authenticated-orcid":false,"given":"Kexian","family":"Liu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4411-0741","authenticated-orcid":false,"given":"Jianfeng","family":"Guan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,7,17]]},"reference":[{"key":"13_CR1","doi-asserted-by":"publisher","first-page":"123","DOI":"10.1016\/j.cose.2018.11.001","volume":"81","author":"D Ucci","year":"2019","unstructured":"Ucci, D., Aniello, L., Baldoni, R.: Survey of machine learning techniques for malware analysis. Comput. Secur. 81, 123\u2013147 (2019)","journal-title":"Comput. Secur."},{"key":"13_CR2","doi-asserted-by":"publisher","first-page":"315","DOI":"10.1016\/j.ins.2023.01.067","volume":"626","author":"D Javaheri","year":"2023","unstructured":"Javaheri, D., Gorgin, S., Lee, J.-A., et al.: Fuzzy logic-based DDoS attacks and network traffic anomaly detection methods: classification, overview, and future perspectives. Inf. Sci. 626, 315\u2013338 (2023)","journal-title":"Inf. Sci."},{"key":"13_CR3","doi-asserted-by":"publisher","first-page":"5011","DOI":"10.1109\/TIFS.2023.3300521","volume":"18","author":"S Cui","year":"2023","unstructured":"Cui, S., Dong, C., Shen, M., et al.: CBSeq: a channel-level behavior sequence for encrypted malware traffic detection. IEEE Trans. Inf. Forensics Secur. 18, 5011\u20135025 (2023)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"13_CR4","doi-asserted-by":"crossref","unstructured":"Li, S., Dong, F., Xiao, X., et al.: NODLINK: an online system for fine-grained APT attack detection and investigation. NDSS (2024)","DOI":"10.14722\/ndss.2024.23204"},{"key":"13_CR5","doi-asserted-by":"crossref","unstructured":"Zhang, J., Moore, A.: Traffic trace artifacts due to monitoring via port mirroring. In: 2007 Workshop on End-to-End Monitoring Techniques and Services (2007)","DOI":"10.1109\/E2EMON.2007.375317"},{"key":"13_CR6","doi-asserted-by":"crossref","unstructured":"Deri, L., Fusco, F.: Using deep packet inspection in cybertraffic analysis. In: CSR, pp. 89--94 (2021)","DOI":"10.1109\/CSR51186.2021.9527976"},{"key":"13_CR7","doi-asserted-by":"crossref","unstructured":"Gupta, S., Gosain, D., Kwon, M., et al.: Deep4r: deep packet inspection in P4 using packet recirculation. In: INFOCOM, pp. 1--10 (2023)","DOI":"10.1109\/INFOCOM53939.2023.10228996"},{"issue":"12","key":"13_CR8","doi-asserted-by":"publisher","first-page":"15031","DOI":"10.1109\/TMC.2024.3450691","volume":"23","author":"C Zhou","year":"2024","unstructured":"Zhou, C., Xiang, Q., et al.: NetDPI: efficient deep packet inspection via filtering-plus-verification in programmable 5G data plane for multi-access edge computing. IEEE Trans. Mob. Comput. 23(12), 15031\u201315047 (2024)","journal-title":"IEEE Trans. Mob. Comput."},{"key":"13_CR9","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2022.117163","volume":"201","author":"W Jiang","year":"2022","unstructured":"Jiang, W.: Cellular traffic prediction with machine learning: a survey. Expert Syst. Appl. 201, 117163 (2022)","journal-title":"Expert Syst. Appl."},{"issue":"1","key":"13_CR10","doi-asserted-by":"publisher","first-page":"791","DOI":"10.1109\/COMST.2022.3208196","volume":"25","author":"M Shen","year":"2023","unstructured":"Shen, M., Ye, K., Liu, X., et al.: Machine learning-powered encrypted network traffic analysis: a comprehensive survey. IEEE Commun. Surv. Tutor. 25(1), 791\u2013824 (2023)","journal-title":"IEEE Commun. Surv. Tutor."},{"issue":"2","key":"13_CR11","doi-asserted-by":"publisher","first-page":"989","DOI":"10.1109\/JIOT.2021.3121517","volume":"9","author":"R Kumar","year":"2021","unstructured":"Kumar, R., Swarnkar, M., Singal, G., et al.: IoT network traffic classification using machine learning algorithms: an experimental analysis. IEEE Internet Things J. 9(2), 989\u20131008 (2021)","journal-title":"IEEE Internet Things J."},{"key":"13_CR12","doi-asserted-by":"crossref","unstructured":"Daniel, N., Kaiser, F. K., Giladi, S., et al.: Labeling Network Intrusion Detection System (NIDS) rules with mitre attck techniques: machine learning vs. large language models. Big Data Cogn. Comput. 9(2) (2025)","DOI":"10.3390\/bdcc9020023"},{"key":"13_CR13","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2024.107603","volume":"164","author":"M Wang","year":"2025","unstructured":"Wang, M., Chen, C., et al.: BCBA: an IIoT Encrypted traffic classifier based on a serial network model. Futur. Gener. Comput. Syst. 164, 107603 (2025)","journal-title":"Futur. Gener. Comput. Syst."},{"key":"13_CR14","doi-asserted-by":"crossref","unstructured":"Liu, Z., Xie, Y., Luo, Y., et al.: Transeca-net: a transformer-based model for encrypted traffic classification. Appl. Sci. 15(6) (2025)","DOI":"10.3390\/app15062977"},{"key":"13_CR15","doi-asserted-by":"crossref","unstructured":"Ginige, Y., Dahanayaka, T., Seneviratne, S.: TrafficGPT: an LLM approach for open-set encrypted traffic classification. In: AINTEC\u201924, pp. 26--35 (2024)","DOI":"10.1145\/3674213.3674217"},{"key":"13_CR16","doi-asserted-by":"crossref","unstructured":"Jebaraj, S., Joshi, M.: Port-based classification of network traffic analysis using the ColasoftCapsa tool for enhanced cybersecurity. In: ICCSAI 2023, pp. 1--5 (2023)","DOI":"10.1109\/ICCSAI59793.2023.10420917"},{"key":"13_CR17","doi-asserted-by":"publisher","first-page":"7091","DOI":"10.1109\/TIFS.2024.3428839","volume":"19","author":"Y Chen","year":"2024","unstructured":"Chen, Y., Wang, Y.: MPAF: encrypted traffic classification with multi-phase attribute fingerprint. IEEE Trans. Inf. Forensics Secur. 19, 7091\u20137105 (2024)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"13_CR18","unstructured":"Vaswani, A., Shazeer, N., Parmar, N., et al.: Attention is all you need. NIPS\u201917, pp. 6000\u20136010 (2017)"},{"key":"13_CR19","unstructured":"Zoph, B., Raffel, C., Schuurmans, D., et al.: Emergent abilities of large language models. TMLR (2022)"},{"key":"13_CR20","doi-asserted-by":"crossref","unstructured":"Chang, Y., Wang, X., Wang, J., et al.: A survey on evaluation of large language models. ACM Trans. Intell. Syst. Technol. 15(3) (2024)","DOI":"10.1145\/3641289"},{"key":"13_CR21","unstructured":"Wang, W., Zhu, M., Zeng, X., et al.: USTC-TFC2016 (2016). https:\/\/github.com\/yungshenglu\/USTC-TFC2016"},{"key":"13_CR22","unstructured":"Draper-Gil, G., Habibi Lashkari, A., Saiful Islam, M., et al.: ISCX VPN-non-VPN Dataset (2016). https:\/\/www.unb.ca\/cic\/datasets\/vpn.html"},{"key":"13_CR23","doi-asserted-by":"publisher","unstructured":"Li, W., Wang, S., Zhai, Y., et al.: Cstnet-TLS1.3: A TLS 1.3 dataset from China science and technology network (2021). https:\/\/doi.org\/10.5281\/zenodo.5034765","DOI":"10.5281\/zenodo.5034765"},{"key":"13_CR24","unstructured":"Zhipu AI and Tsinghua University KEG: Chatglm2\u20136b: an enhanced bilingual dialogue language model with 6.2b parameters. Technical Report (2023)"},{"key":"13_CR25","doi-asserted-by":"crossref","unstructured":"Van Ede, T., Bortolameotti, R., et al.: Flowprint: semi-supervised mobile-app fingerprinting on encrypted network traffic. NDSS (2020)","DOI":"10.14722\/ndss.2020.24412"},{"key":"13_CR26","doi-asserted-by":"crossref","unstructured":"Taylor, V.F., Spolaor, R., Conti, M., et al.: Appscanner: automatic fingerprinting of smartphone apps from encrypted network traffic. In: EuroSP (2016)","DOI":"10.1109\/EuroSP.2016.40"},{"key":"13_CR27","doi-asserted-by":"crossref","unstructured":"Al-Naami, K., Chandra, S., Mustafa, A., et al.: Adaptive encrypted traffic fingerprinting with bi-directional dependence. In: ACSAC 2016, pp. 177\u2013188 (2016)","DOI":"10.1145\/2991079.2991123"},{"key":"13_CR28","doi-asserted-by":"crossref","unstructured":"Sirinam, P., Imani, M., Juarez, M., et al.: Deep fingerprinting: undermining website fingerprinting defenses with deep learning. In: CCS 2018, pp. 1928\u20131943 (2018)","DOI":"10.1145\/3243734.3243768"},{"key":"13_CR29","doi-asserted-by":"publisher","first-page":"2367","DOI":"10.1109\/TIFS.2021.3050608","volume":"16","author":"M Shen","year":"2021","unstructured":"Shen, M., Zhang, J., et al.: Accurate decentralized application identification via encrypted traffic analysis using graph neural networks. IEEE Trans. Inf. Forensics Secur. 16, 2367\u20132380 (2021)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"13_CR30","doi-asserted-by":"crossref","unstructured":"He, H. Y., Yang, Z. G., Chen, X.N.: Pert: payload encoding representation from transformer for encrypted traffic classification. In: 2020 ITU Kaleidoscope: Industry-Driven Digital Transformation (ITU K), pp. 1\u20138 (2020)","DOI":"10.23919\/ITUK50268.2020.9303204"},{"key":"13_CR31","first-page":"633","volume":"22","author":"XJ Lin","year":"2022","unstructured":"Lin, X.J., Xiong, G., Gou, G.P., et al.: ET-Bert: a contextualized datagram representation with pre-training transformers for encrypted traffic classification. WWW 22, 633\u2013642 (2022)","journal-title":"WWW"},{"key":"13_CR32","doi-asserted-by":"publisher","first-page":"5420","DOI":"10.1609\/aaai.v37i4.25674","volume":"2023","author":"RJ Zhao","year":"2023","unstructured":"Zhao, R.J., Zhan, M.W., Deng, X.W., et al.: Yet another traffic classifier: a masked autoencoder based traffic transformer with multi-level flow representation. AAAI 2023, 5420\u20135427 (2023)","journal-title":"AAAI"},{"key":"13_CR33","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2024.110973","volume":"257","author":"MM Zhan","year":"2025","unstructured":"Zhan, M.M., Yang, J., et al.: EAPT: an encrypted traffic classification model via adversarial pre-trained transformers. Comput. Netw. 257, 110973 (2025)","journal-title":"Comput. Netw."},{"key":"13_CR34","doi-asserted-by":"crossref","unstructured":"Zhou, G.M., Guo, X.W., et al.: Trafficformer: an efficient pre-trained model for traffic data. In: 2025 IEEE Symposium on Security and Privacy (2025)","DOI":"10.1109\/SP61157.2025.00102"}],"container-title":["Lecture Notes in Computer Science","Advanced Intelligent Computing Technology and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-96-9914-8_13","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T10:39:27Z","timestamp":1772447967000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-96-9914-8_13"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9789819699131","9789819699148"],"references-count":34,"URL":"https:\/\/doi.org\/10.1007\/978-981-96-9914-8_13","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"17 July 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ICIC","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Intelligent Computing","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Ningbo","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"China","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 July 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"29 July 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"21","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"icic2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/www.ic-icc.cn\/icg\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}