{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T12:23:39Z","timestamp":1783513419214,"version":"3.55.0"},"reference-count":40,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372380"],"award-info":[{"award-number":["62372380"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U22B2036"],"award-info":[{"award-number":["U22B2036"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100017596","name":"Natural Science Basic Research Program of Shaanxi Province","doi-asserted-by":"publisher","award":["2024JC-YBMS-513"],"award-info":[{"award-number":["2024JC-YBMS-513"]}],"id":[{"id":"10.13039\/501100017596","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100015401","name":"Key Research and Development Projects of Shaanxi Province","doi-asserted-by":"publisher","award":["2024GX-ZDCYL-01-05"],"award-info":[{"award-number":["2024GX-ZDCYL-01-05"]}],"id":[{"id":"10.13039\/501100015401","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100015804","name":"China Computer Federation","doi-asserted-by":"publisher","award":["CCF-NSFOCUS2025003"],"award-info":[{"award-number":["CCF-NSFOCUS2025003"]}],"id":[{"id":"10.13039\/100015804","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2022YFB3104005"],"award-info":[{"award-number":["2022YFB3104005"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computer Networks"],"published-print":{"date-parts":[[2026,8]]},"DOI":"10.1016\/j.comnet.2026.112433","type":"journal-article","created":{"date-parts":[[2026,5,30]],"date-time":"2026-05-30T06:35:45Z","timestamp":1780122945000},"page":"112433","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Fine-grained network traffic classification with hybrid retrieval and LLM re-ranking"],"prefix":"10.1016","volume":"286","author":[{"given":"Huimin","family":"Chen","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dehong","family":"Gao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Libin","family":"Yang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wei","family":"Lou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wenxiao","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zibo","family":"Zhou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.comnet.2026.112433_b1","first-page":"1","article-title":"Design of smart system for mitigating wild animal intrusion in agricultural farms using IoT and deep learning","volume":"vol. 3","author":"Prasanth","year":"2025"},{"key":"10.1016\/j.comnet.2026.112433_b2","series-title":"Multimedia Security","first-page":"177","article-title":"A future cyber security for secured smart home applications using the Internet of Things and blockchain technology","author":"Arulkumar","year":"2025"},{"key":"10.1016\/j.comnet.2026.112433_b3","series-title":"Technological Advancement in Internet of Medical Things and Blockchain for Personalized Healthcare: Applications and Use Cases","author":"Prasanth","year":"2024"},{"key":"10.1016\/j.comnet.2026.112433_b4","article-title":"An energy-aware link fault detection and recovery scheme for QoS enhancement in Internet of Things-enabled wireless sensor network","volume":"123","author":"Prasanth","year":"2025","journal-title":"Comput. Electr. Eng."},{"key":"10.1016\/j.comnet.2026.112433_b5","doi-asserted-by":"crossref","unstructured":"F. Kaiser, H. Shulman, M. Waidner, Poster: Longitudinal Analysis of DoS Attacks, in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 3573\u20133575.","DOI":"10.1145\/3576915.3624382"},{"key":"10.1016\/j.comnet.2026.112433_b6","doi-asserted-by":"crossref","unstructured":"R. Hiesgen, M. Nawrocki, M. Barcellos, D. Kopp, O. Hohlfeld, E. Chan, R. Dobbins, C. Doerr, C. Rossow, D.R. Thomas, et al., The age of DDoScovery: an empirical comparison of industry and academic DDoS assessments, in: Proceedings of the ACM on Internet Measurement Conference, 2024, pp. 259\u2013279.","DOI":"10.1145\/3646547.3688451"},{"key":"10.1016\/j.comnet.2026.112433_b7","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2024.112614","article-title":"Enhancing the security in IoT and iIoT networks: An intrusion detection scheme leveraging deep transfer learning","volume":"305","author":"Ahmad","year":"2024","journal-title":"Knowl.-Based Syst."},{"key":"10.1016\/j.comnet.2026.112433_b8","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2024.112563","article-title":"Semi-supervised intrusion detection system for in-vehicle networks based on variational autoencoder and adversarial reinforcement learning","volume":"304","author":"Nguyen","year":"2024","journal-title":"Knowl.-Based Syst."},{"key":"10.1016\/j.comnet.2026.112433_b9","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2025.104510","article-title":"Network intrusion datasets: a survey, limitations, and recommendations","author":"Goldschmidt","year":"2025","journal-title":"Comput. Secur."},{"key":"10.1016\/j.comnet.2026.112433_b10","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2025.114436","article-title":"Multi-class intrusion detection system for in-vehicle networks using few-shot learning and convolutional anomaly transformer network","author":"Duy","year":"2025","journal-title":"Knowl.-Based Syst."},{"key":"10.1016\/j.comnet.2026.112433_b11","series-title":"24th International Conference on Advanced Communication Technology","first-page":"323","article-title":"Autoencoder ensembles for network intrusion detection","author":"Long","year":"2022"},{"issue":"6","key":"10.1016\/j.comnet.2026.112433_b12","doi-asserted-by":"crossref","first-page":"1209","DOI":"10.1007\/s00607-021-00912-2","article-title":"Adaptive ensembles of autoencoders for unsupervised IoT network intrusion detection","volume":"103","author":"Siddiqui","year":"2021","journal-title":"Computing"},{"key":"10.1016\/j.comnet.2026.112433_b13","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1109\/TIFS.2023.3318966","article-title":"WF-transformer: Learning temporal features for accurate anonymous traffic identification by using transformer networks","volume":"19","author":"Zhou","year":"2023","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.comnet.2026.112433_b14","article-title":"MFT: A Novel Memory-Flow Transformer Efficient Intrusion Detection Method","volume":"140","author":"Jiang","year":"2025","journal-title":"Comput. Secur."},{"key":"10.1016\/j.comnet.2026.112433_b15","doi-asserted-by":"crossref","unstructured":"C. Fu, Q. Li, M. Shen, K. Xu, Detecting tunneled flooding traffic via deep semantic analysis of packet length patterns, in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 3659\u20133673.","DOI":"10.1145\/3658644.3670353"},{"key":"10.1016\/j.comnet.2026.112433_b16","doi-asserted-by":"crossref","unstructured":"L. Zhao, Y. Zhang, Z. Wang, F. Yuan, R. Hou, ERW-Radar: An Adaptive Detection System against Evasive Ransomware by Contextual Behavior Detection and Fine-grained Content Analysis, in: Proceedings of the Network and Distributed System Security Symposium, 2025.","DOI":"10.14722\/ndss.2025.230349"},{"key":"10.1016\/j.comnet.2026.112433_b17","doi-asserted-by":"crossref","unstructured":"S. Xi, T. Fu, K. Bu, C. Yang, Z. Chang, W. Chen, Z. Ma, C. Chen, Y. Shen, K. Ren, MineShark: Cryptomining Traffic Detection at Scale, in: Proceedings of the Network and Distributed System Security Symposium, 2025.","DOI":"10.14722\/ndss.2025.230402"},{"issue":"000","key":"10.1016\/j.comnet.2026.112433_b18","first-page":"15","article-title":"Encrypted malicious traffic detection based on natural language processing and deep learning","volume":"250","author":"Zang","year":"2024","journal-title":"Comput. Netw."},{"key":"10.1016\/j.comnet.2026.112433_b19","doi-asserted-by":"crossref","unstructured":"H. Kim, K.C. Claffy, M. Fomenkov, D. Barman, M. Faloutsos, K. Lee, Internet traffic classification demystified: myths, caveats, and the best practices, in: Proceedings of the ACM CoNEXT Conference, 2008, pp. 1\u201312.","DOI":"10.1145\/1544012.1544023"},{"issue":"4","key":"10.1016\/j.comnet.2026.112433_b20","doi-asserted-by":"crossref","first-page":"56","DOI":"10.1109\/SURV.2008.080406","article-title":"A survey of techniques for internet traffic classification using machine learning","volume":"10","author":"Nguyen","year":"2008","journal-title":"IEEE Commun. Surv. & Tutorials"},{"key":"10.1016\/j.comnet.2026.112433_b21","series-title":"Understanding the Limits of Deep Packet Inspection for Network Traffic Classification","author":"Ramey","year":"2024"},{"issue":"18","key":"10.1016\/j.comnet.2026.112433_b22","doi-asserted-by":"crossref","first-page":"7760","DOI":"10.3390\/s23187760","article-title":"Classification of malicious URLs using machine learning","volume":"23","author":"Abad","year":"2023","journal-title":"Sensors"},{"key":"10.1016\/j.comnet.2026.112433_b23","first-page":"517","article-title":"A deep learning-based method for HTTP payload classification in attack detection","volume":"vol. 12814","author":"Zhu","year":"2023"},{"key":"10.1016\/j.comnet.2026.112433_b24","series-title":"Network traffic classification using machine learning, transformer, and large language models","author":"Antari","year":"2025"},{"key":"10.1016\/j.comnet.2026.112433_b25","doi-asserted-by":"crossref","unstructured":"I. Ali, B. Subba, PhishURLDetect: A parameter efficient fine-tuning of LLMs using LoRA for detection of phishing URLs, in: Proceedings of the 26th International Conference on Distributed Computing and Networking, 2025, pp. 278\u2013279.","DOI":"10.1145\/3700838.3703658"},{"key":"10.1016\/j.comnet.2026.112433_b26","series-title":"LLM-powered intent-based categorization of phishing emails","author":"Eilertsen","year":"2025"},{"key":"10.1016\/j.comnet.2026.112433_b27","doi-asserted-by":"crossref","unstructured":"R. Zhao, X. Deng, Z. Yan, J. Ma, Z. Xue, Y. Wang, Mt-flowformer: A semi-supervised flow transformer for encrypted traffic classification, in: Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2022, pp. 2576\u20132584.","DOI":"10.1145\/3534678.3539314"},{"issue":"3","key":"10.1016\/j.comnet.2026.112433_b28","doi-asserted-by":"crossref","first-page":"1071","DOI":"10.1109\/TNET.2022.3209979","article-title":"A two-phase approach to fast and accurate classification of encrypted traffic","volume":"31","author":"Wang","year":"2022","journal-title":"IEEE\/ACM Trans. Netw."},{"issue":"3","key":"10.1016\/j.comnet.2026.112433_b29","doi-asserted-by":"crossref","first-page":"2161","DOI":"10.1109\/TDSC.2024.3478838","article-title":"RBLJAN: Robust byte-label joint attention network for network traffic classification","volume":"22","author":"Xiao","year":"2025","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"10.1016\/j.comnet.2026.112433_b30","doi-asserted-by":"crossref","unstructured":"X. Lin, G. Xiong, G. Gou, Z. Li, J. Shi, J. Yu, Et-bert: A contextualized datagram representation with pre-training transformers for encrypted traffic classification, in: Proceedings of the ACM Web Conference, 2022, pp. 633\u2013642.","DOI":"10.1145\/3485447.3512217"},{"key":"10.1016\/j.comnet.2026.112433_b31","doi-asserted-by":"crossref","first-page":"9374","DOI":"10.1109\/TIFS.2024.3433446","article-title":"ATVITSC: A novel encrypted traffic classification method based on deep learning","volume":"19","author":"Liu","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.comnet.2026.112433_b32","series-title":"32nd International Conference on Network Protocols","first-page":"1","article-title":"Netmamba: Efficient network traffic classification via pre-training unidirectional mamba","author":"Wang","year":"2024"},{"key":"10.1016\/j.comnet.2026.112433_b33","series-title":"Towards explainable network intrusion detection using large language models","author":"Houssel","year":"2024"},{"key":"10.1016\/j.comnet.2026.112433_b34","series-title":"International Conference on Advanced Information Networking and Applications","first-page":"453","article-title":"Harnessing the advanced capabilities of LLM for adaptive intrusion detection systems","author":"G. Lira","year":"2024"},{"key":"10.1016\/j.comnet.2026.112433_b35","series-title":"International Conference on Big Data","first-page":"7282","article-title":"Enhancing network traffic classification with large language models","author":"Zhou","year":"2024"},{"key":"10.1016\/j.comnet.2026.112433_b36","series-title":"Conference on Dependable and Secure Computing","first-page":"45","article-title":"Fine-tuning large language models for network traffic analysis in cyber security","author":"Lavi","year":"2024"},{"key":"10.1016\/j.comnet.2026.112433_b37","doi-asserted-by":"crossref","unstructured":"J. Devlin, M.-W. Chang, K. Lee, K. Toutanova, Bert: Pre-training of deep bidirectional transformers for language understanding, in: Proceedings of the Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, 2019, pp. 4171\u20134186.","DOI":"10.18653\/v1\/N19-1423"},{"key":"10.1016\/j.comnet.2026.112433_b38","series-title":"RoBERTa: A robustly optimized BERT pretraining approach","author":"Liu","year":"2019"},{"key":"10.1016\/j.comnet.2026.112433_b39","series-title":"International Conference on Security and Privacy in Communication Systems","first-page":"39","article-title":"Securebert: A domain-specific language model for cybersecurity","author":"Aghaei","year":"2022"},{"key":"10.1016\/j.comnet.2026.112433_b40","doi-asserted-by":"crossref","unstructured":"Z. Qin, R. Jagerman, K. Hui, H. Zhuang, J. Wu, L. Yan, J. Shen, T. Liu, J. Liu, D. Metzler, et al., Large language models are effective text rankers with pairwise ranking prompting, in: Findings of the Association for Computational Linguistics, 2024.","DOI":"10.18653\/v1\/2024.findings-naacl.97"}],"container-title":["Computer Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128626004457?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128626004457?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T11:57:30Z","timestamp":1783511850000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S1389128626004457"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8]]},"references-count":40,"alternative-id":["S1389128626004457"],"URL":"https:\/\/doi.org\/10.1016\/j.comnet.2026.112433","relation":{},"ISSN":["1389-1286"],"issn-type":[{"value":"1389-1286","type":"print"}],"subject":[],"published":{"date-parts":[[2026,8]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Fine-grained network traffic classification with hybrid retrieval and LLM re-ranking","name":"articletitle","label":"Article Title"},{"value":"Computer Networks","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.comnet.2026.112433","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Published by Elsevier B.V.","name":"copyright","label":"Copyright"}],"article-number":"112433"}}