{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,14]],"date-time":"2026-07-14T14:20:27Z","timestamp":1784038827072,"version":"3.55.0"},"reference-count":306,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"6","license":[{"start":{"date-parts":[[2025,12,1]],"date-time":"2025-12-01T00:00:00Z","timestamp":1764547200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,12,1]],"date-time":"2025-12-01T00:00:00Z","timestamp":1764547200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,12,1]],"date-time":"2025-12-01T00:00:00Z","timestamp":1764547200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001381","name":"National Research Foundation, Singapore, and the Cyber Security Agency under its National Cybersecurity R&D Programme","doi-asserted-by":"publisher","award":["NCRP25-P04-TAICeN"],"award-info":[{"award-number":["NCRP25-P04-TAICeN"]}],"id":[{"id":"10.13039\/501100001381","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100018542","name":"Natural Science Foundation of Sichuan Province","doi-asserted-by":"publisher","award":["2024NSFSC1450"],"award-info":[{"award-number":["2024NSFSC1450"]}],"id":[{"id":"10.13039\/501100018542","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Cyber Security Academic Startup Accelerator Programme (CyberASAP) of Innovate U.K.","award":["10120020"],"award-info":[{"award-number":["10120020"]}]},{"name":"Cyber Security Academic Startup Accelerator Programme (CyberASAP) of Innovate U.K.","award":["10140441"],"award-info":[{"award-number":["10140441"]}]},{"name":"Ripple under the University Blockchain Research Initiative (UBRI) [306]"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Commun. Surv. Tutorials"],"published-print":{"date-parts":[[2025,12]]},"DOI":"10.1109\/comst.2025.3545541","type":"journal-article","created":{"date-parts":[[2025,2,25]],"date-time":"2025-02-25T13:59:33Z","timestamp":1740491973000},"page":"3672-3709","source":"Crossref","is-referenced-by-count":25,"title":["Unmasking the Internet: A Survey of Fine-Grained Network Traffic Analysis"],"prefix":"10.1109","volume":"27","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7235-2377","authenticated-orcid":false,"given":"Yebo","family":"Feng","sequence":"first","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Jurong West, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5308-5672","authenticated-orcid":false,"given":"Jun","family":"Li","sequence":"additional","affiliation":[{"name":"Computer Science Department, University of Oregon, Eugene, OR, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7462-8747","authenticated-orcid":false,"given":"Jelena","family":"Mirkovic","sequence":"additional","affiliation":[{"name":"Information Sciences Institute, University of Southern California, Marina del Rey, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0930-0283","authenticated-orcid":false,"given":"Cong","family":"Wu","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Jurong West, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1424-6290","authenticated-orcid":false,"given":"Chong","family":"Wang","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Jurong West, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7909-3753","authenticated-orcid":false,"given":"Hao","family":"Ren","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Jurong West, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3993-5263","authenticated-orcid":false,"given":"Jiahua","family":"Xu","sequence":"additional","affiliation":[{"name":"Computer Science Department, University College London, London, U.K."}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7300-9215","authenticated-orcid":false,"given":"Yang","family":"Liu","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Jurong West, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4615-6698-4"},{"key":"ref2","volume-title":"Internet protocol suite","year":"2021"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-44702-4_2"},{"key":"ref4","volume-title":"A Survey of Network Traffic Monitoring and Analysis Tools: CSE 576m Computer System Analysis Project","author":"So-In","year":"2009"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2019.2933358"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3457904"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2883147"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(99)00112-7"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/1544012.1544023"},{"key":"ref10","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2020.102596","article-title":"On the classification of fog computing applications: A machine learning perspective","volume":"159","author":"Guevara","year":"2020","journal-title":"J. Netw. Comput. Appl."},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(01)00304-8"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.21236\/ADA439086"},{"key":"ref13","article-title":"Measuring changes in regional network traffic due to COVID-19 stay-at-home measures","author":"Mirkovic","year":"2022","journal-title":"arXiv:2203.00742"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/637201.637210"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/1162678.1162679"},{"key":"ref16","article-title":"A survey of sketches in traffic measurement: Design, optimization, application and implementation","author":"Li","year":"2020","journal-title":"arXiv:2012.07214"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2023.109696"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2022.3208196"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_15"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24412"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2019.8802706"},{"key":"ref22","first-page":"1357","article-title":"Beauty and the burst: Remote identification of encrypted video streams","volume-title":"Proc. 26th {USENIX} Secur. Symp.","author":"Schuster"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098163"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3342195.3387558"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3104869"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098049"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-25645-0_4"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3236261"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3205023"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2020.3001195"},{"key":"ref31","article-title":"IoT network traffic analysis: Opportunities and challenges for forensic investigators?","volume":"38","author":"Wu","year":"2021","journal-title":"Forensic Sci. Int., Digit. Invest."},{"key":"ref32","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2020.102538","article-title":"The rise of traffic classification in IoT networks: A survey","volume":"154","author":"Tahaei","year":"2020","journal-title":"J. Netw. Comput. Appl."},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2843533"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2491361"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1002\/nem.1901"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.100613.00161"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/2480741.2480747"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2009.090304"},{"key":"ref39","volume-title":"Survey of Network Traffic Models","author":"Chandrasekaran","year":"2009"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2002.1015008"},{"key":"ref41","volume-title":"A Summary of Network Traffic Monitoring and Analysis Techniques: Computer Systems Analysis","author":"Cecil","year":"2006"},{"issue":"4","key":"ref42","first-page":"1372","article-title":"Active and passive network measurements: a survey","volume":"2","author":"Mohan","year":"2011","journal-title":"Int. J. Comput. Sci. Inf. Technol."},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2021.01.021"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/2381913.2381915"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2018.8486375"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3016076"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2007.30"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2016.2604405"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1049\/iet-com.2017.1053"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/ICCNMC.2003.1243024"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOM.2005.1577769"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2008.4483669"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2014.06.002"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2011.5741152"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/2620728.2620739"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/2934732.2934746"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CSCWD.2018.8465367"},{"key":"ref58","volume-title":"Enabling Collaborative Network Security with Privacy-Preserving Data Aggregation","author":"Burkhart","year":"2011"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/3368926.3369705"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.2991401"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2023.109950"},{"key":"ref62","volume-title":"Solaris snoop packet sniffer","year":"2022"},{"key":"ref63","volume-title":"Wireshark & Ethereal Network Protocol Analyzer Toolkit","author":"Orebaugh","year":"2006"},{"key":"ref64","volume-title":"Data sheet of sniffer infinistream","year":"2022"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.17487\/rfc6146"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.17487\/rfc2722"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.17487\/rfc3697"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.17487\/rfc3917"},{"key":"ref69","volume-title":"Cflowd Design","author":"McRobb","year":"1998"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2014.2321898"},{"key":"ref71","volume-title":"Calculating netflow volume","author":"Lee","year":"2013"},{"key":"ref72","first-page":"1","article-title":"On the accuracy and overhead of Cisco sampled netflow","volume-title":"Proc. ACM SIGMETRICS Workshop Large Scale Netw. Inference (LSNI)","author":"Choi"},{"key":"ref73","volume-title":"Simple network management protocol (SNMP)","author":"Hare","year":"2011"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.17487\/rfc7011"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.17487\/rfc3954"},{"key":"ref76","volume-title":"Netflow v5 formats","year":"2022"},{"key":"ref77","volume-title":"Argus project","year":"2021"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.17487\/rfc3176"},{"key":"ref79","volume-title":"Tcpdump & libpcap","year":"2022"},{"key":"ref80","volume-title":"Pf_ring documentation","year":"2022"},{"key":"ref81","first-page":"101","article-title":"netmap: A novel framework for fast packet I\/O","volume-title":"Proc. 21st USENIX Secur. Symp.","author":"Rizzo"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1145\/2740070.2626310"},{"issue":"2","key":"ref83","first-page":"88","article-title":"Network monitoring approaches: An overview","volume":"5","author":"Svoboda","year":"2015","journal-title":"Int J Adv Comput Netw Secur"},{"key":"ref84","first-page":"793","article-title":"Design of a real-time traffic mirroring system","volume-title":"Proc. IFIP\/IEEE Int. Symp. Integr. Netw. Manag. (IM)","author":"Wang"},{"key":"ref85","volume-title":"ProfiShark network TAPs","year":"2019"},{"key":"ref86","volume-title":"Argus\u2014Audit record generation and utilization system","year":"2000"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-00975-4_19"},{"key":"ref88","volume-title":"Configuration Guide\u2014Network Management and Monitoring","year":"2022"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.17487\/rfc3577"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1145\/3281411.3281443"},{"key":"ref91","first-page":"973","article-title":"{hXDP}: Efficient software packet processing on {FPGA}{NICs}","volume-title":"Proc. 14th USENIX Symp. Oper. Syst. Design Implement. (OSDI)","author":"Brunella"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1145\/3387514.3406214"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1145\/356770.356776"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-57959-7"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1145\/3098822.3098831"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1145\/3230543.3230544"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1145\/3366699"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2023.3303924"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2023.3257226"},{"key":"ref100","first-page":"1273","article-title":"Sketchovsky: Enabling ensembles of sketches on programmable switches","volume-title":"Proc. 20th USENIX Symp. Netw. Syst. Design Implement. (NSDI)","author":"Namkung"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/GLOBECOM48099.2022.10001510"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3047399"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1145\/3326285.3329053"},{"key":"ref104","volume-title":"Feature Extraction: Foundations and Applications","volume":"207","author":"Guyon","year":"2008"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/SAI.2014.6918213"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.38094\/jastt1224"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1007\/s10489-021-02550-9"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1145\/2939918.2939929"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/WINCOM.2016.7777224"},{"key":"ref110","article-title":"How to achieve high classification accuracy with just a few labels: A semi-supervised approach using sampled packets","author":"Rezaei","year":"2018","journal-title":"arXiv:1812.09761"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1145\/1629607.1629610"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1145\/3545948.3545973"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/IPCCC47392.2019.8958721"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1007\/11767831_1"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382260"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2016.2516020"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-63095-9_4"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2019.106944"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1007\/s00500-019-04030-2"},{"issue":"2","key":"ref120","first-page":"1","article-title":"Unsupervised network intrusion detection systems for zero-day fast-spreading attacks and botnets","volume":"10","author":"Amoli","year":"2016","journal-title":"Int. J. Digit. Content Technol. Appl."},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2017.2772792"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1002\/047120644X.ch1"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2004.826605"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1002\/9780470277331"},{"key":"ref125","first-page":"41","article-title":"An empirical study of the naive Bayes classifier","volume-title":"Proc. Workshop Empir. Methods Artif. Intell.","volume":"3","author":"Rish"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4899-4483-2"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/MASSP.1986.1165342"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1126\/science.aaa8415"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1038\/nature14539"},{"key":"ref130","volume-title":"Deep Learning","author":"Goodfellow","year":"2016"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2023.109780"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2022.109461"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.108739"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3253559"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1186\/s13638-022-02103-9"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1145\/3485447.3512217"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2022.118641"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2019.2904363"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2022.108836"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.5555\/3026877.3026899"},{"key":"ref141","first-page":"8026","article-title":"PyTorch: An imperative style, high-performance deep learning library","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Paszke"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1145\/2647868.2654889"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-22475-2_1"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2916648"},{"issue":"66","key":"ref145","first-page":"13","article-title":"Dimensionality reduction: A comparative","volume":"10","author":"Van Der Maaten","year":"2009","journal-title":"J. Mach. Learn. Res."},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.2307\/2346830"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.4135\/9781412985475"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1002\/widm.53"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.1038\/nmeth.3945"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24067"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3301293"},{"key":"ref152","doi-asserted-by":"publisher","DOI":"10.2307\/j.ctvjghvnn"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2017.02.011"},{"key":"ref154","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23204"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23536"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.23919\/IFIPNetworking.2019.8816854"},{"key":"ref157","volume-title":"Kentik\u2014The network observability platform","year":"2023"},{"key":"ref158","volume-title":"Hunt down and stop tomorrow\u2019s threats, today\u2014Analyze network traffic with best-in-class machine learning and analytics","author":"Networks","year":"2023"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2007.205"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1145\/1280940.1280966"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-59621-7_6"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.1145\/1541880.1541882"},{"key":"ref163","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.24830"},{"key":"ref164","doi-asserted-by":"publisher","DOI":"10.1016\/j.dcan.2023.03.008"},{"key":"ref165","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.02.009"},{"key":"ref166","doi-asserted-by":"publisher","DOI":"10.1109\/IWQoS.2016.7590446"},{"key":"ref167","doi-asserted-by":"publisher","DOI":"10.1109\/PST.2017.00035"},{"key":"ref168","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3453101"},{"key":"ref169","doi-asserted-by":"publisher","DOI":"10.1145\/2906388.2906392"},{"key":"ref170","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23465"},{"issue":"12","key":"ref171","doi-asserted-by":"crossref","first-page":"2584","DOI":"10.3390\/electronics12122584","article-title":"Data exfiltration detection on network metadata with autoencoders","volume":"12","author":"Willems","year":"2023","journal-title":"Electronics"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1109\/TCYB.2019.2940940"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.3390\/s21041140"},{"key":"ref174","first-page":"1","article-title":"A comprehensive data set for network intrusion detection systems","volume-title":"Proc. Mil. Commun. Inf. Syst. Conf.","author":"Moustafa"},{"key":"ref175","doi-asserted-by":"publisher","DOI":"10.1145\/2348543.2348563"},{"key":"ref176","doi-asserted-by":"publisher","DOI":"10.1145\/2619091"},{"key":"ref177","article-title":"Haystack: In situ mobile traffic analysis in user space","author":"Razaghpanah","year":"2015","journal-title":"arXiv:1510.01419"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1145\/2808117.2808120"},{"key":"ref179","doi-asserted-by":"publisher","DOI":"10.1145\/2787394.2787396"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1145\/1656274.1656278"},{"key":"ref181","doi-asserted-by":"publisher","DOI":"10.1145\/3320269.3405440"},{"key":"ref182","article-title":"Relationship between quality-of-service and quality-of-experience for public Internet service","volume-title":"Proc. 3rd Workshop Passive Active Meas.","volume":"1","author":"Khirman"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.1109\/65.768484"},{"key":"ref184","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2016.12.019"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.1007\/s11277-020-07812-2"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1109\/TASE.2021.3077537"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108529"},{"key":"ref188","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOMW.2019.8845132"},{"key":"ref189","doi-asserted-by":"publisher","DOI":"10.1002\/ett.4394"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1016\/j.bdr.2021.100289"},{"key":"ref191","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2007.10.008"},{"key":"ref192","first-page":"365","article-title":"QoE analysis of a peer-to-peer television system","volume-title":"Proc. IADISInt. Conf. Telecommun., Netw. Syst.","author":"Agboma"},{"key":"ref193","doi-asserted-by":"publisher","DOI":"10.1145\/2987443.2987459"},{"key":"ref194","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOMW.2016.7849088"},{"key":"ref195","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2018.8486321"},{"key":"ref196","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-70630-4_5"},{"key":"ref197","volume-title":"Experimental defense for Website traffic fingerprinting","author":"Perry","year":"2011"},{"key":"ref198","volume-title":"Shadowsocks\u2014A fast tunnel proxy that helps you bypass firewalls","year":"2022"},{"key":"ref199","volume-title":"Quantifying traffic analysis of encrypted web-browsing","author":"Mistry","year":"1998"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.2002.1004359"},{"key":"ref201","doi-asserted-by":"publisher","DOI":"10.1145\/1180405.1180437"},{"key":"ref202","doi-asserted-by":"publisher","DOI":"10.1145\/1655008.1655013"},{"key":"ref203","doi-asserted-by":"publisher","DOI":"10.1145\/2046556.2046570"},{"key":"ref204","first-page":"143","article-title":"Effective attacks and provable defenses for Website fingerprinting","volume-title":"Proc. 23rd USENIX Security Symp. (USENIX Security)","author":"Wang"},{"key":"ref205","first-page":"1187","article-title":"K-fingerprinting: A robust scalable Website fingerprinting technique","volume-title":"Proc. 25th USENIX Security Symp. (USENIX Security)","author":"Hayes"},{"key":"ref206","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23105"},{"key":"ref207","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243768"},{"key":"ref208","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354217"},{"key":"ref209","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3158086"},{"key":"ref210","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179464"},{"key":"ref211","doi-asserted-by":"publisher","DOI":"10.17487\/rfc2616"},{"key":"ref212","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-36467-6_13"},{"key":"ref213","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-15497-3_13"},{"key":"ref214","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-70630-4_8"},{"key":"ref215","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423351"},{"key":"ref216","volume-title":"Tor protocol specification","author":"Dingledine","year":"2021"},{"key":"ref217","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.28"},{"key":"ref218","doi-asserted-by":"publisher","DOI":"10.1145\/2517840.2517851"},{"key":"ref219","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660368"},{"key":"ref220","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23477"},{"key":"ref221","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660362"},{"key":"ref222","first-page":"1375","article-title":"Walkie-talkie: An efficient defense against passive Website fingerprinting attacks","volume-title":"Proc. 26th USENIX Security Symp. (USENIX Security)","author":"Wang"},{"key":"ref223","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-45744-4_2"},{"key":"ref224","first-page":"15","article-title":"Fingerprinting attack on Tor anonymity using deep learning","volume-title":"Proc. Asia-Pacific Adv. Netw.","volume":"42","author":"Abe"},{"key":"ref225","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2019-0070"},{"key":"ref226","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref227","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2019-0043"},{"key":"ref228","doi-asserted-by":"publisher","DOI":"10.1145\/3422337.3447835"},{"key":"ref229","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2021-0078"},{"key":"ref230","doi-asserted-by":"publisher","DOI":"10.1177\/0165551515602847"},{"key":"ref231","doi-asserted-by":"publisher","DOI":"10.1145\/2187980.2188181"},{"key":"ref232","doi-asserted-by":"publisher","DOI":"10.1109\/COMSNETS.2012.6151305"},{"key":"ref233","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2009.5204168"},{"key":"ref234","doi-asserted-by":"publisher","DOI":"10.1145\/1644893.1644926"},{"key":"ref235","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2014.6848021"},{"key":"ref236","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2016.2623950"},{"key":"ref237","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815680"},{"key":"ref238","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2016.2599878"},{"key":"ref239","first-page":"40","article-title":"Passive operating system identification from TCP\/IP packet headers","volume-title":"Proc. Workshop Data Min. Comput. Security","volume":"40","author":"Lippmann"},{"key":"ref240","doi-asserted-by":"publisher","DOI":"10.1145\/2663716.2663745"},{"key":"ref241","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS47738.2020.9110319"},{"key":"ref242","doi-asserted-by":"publisher","DOI":"10.1109\/CCNC.2016.7444941"},{"key":"ref243","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2017.2747560"},{"key":"ref244","doi-asserted-by":"publisher","DOI":"10.1145\/3019612.3019878"},{"key":"ref245","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2018.2866249"},{"key":"ref246","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2019.2901348"},{"key":"ref247","doi-asserted-by":"publisher","DOI":"10.1145\/1129582.1129589"},{"key":"ref248","doi-asserted-by":"publisher","DOI":"10.1145\/1080091.1080119"},{"key":"ref249","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-71617-4_17"},{"key":"ref250","doi-asserted-by":"publisher","DOI":"10.1145\/1368436.1368445"},{"key":"ref251","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24668-8_21"},{"key":"ref252","doi-asserted-by":"publisher","DOI":"10.1145\/1064212.1064220"},{"key":"ref253","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2017.8258054"},{"key":"ref254","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2024.3350080"},{"key":"ref255","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2015.7346855"},{"key":"ref256","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.40"},{"key":"ref257","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2017.11.007"},{"key":"ref258","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485925"},{"key":"ref259","doi-asserted-by":"publisher","DOI":"10.1145\/3297280.3297430"},{"key":"ref260","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3050608"},{"key":"ref261","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2737970"},{"key":"ref262","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2019.2899085"},{"key":"ref263","doi-asserted-by":"publisher","DOI":"10.1145\/2677046.2677048"},{"key":"ref264","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2008.21"},{"key":"ref265","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2015.2478741"},{"key":"ref266","first-page":"69","article-title":"Eavesdropping on fine-grained user activities within smartphone apps over encrypted network traffic","volume-title":"Proc. 10th USENIX Workshop Offensive Technol. (WOOT)","author":"Saltaformaggio"},{"key":"ref267","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom\/BigDataSE.2018.00198"},{"key":"ref268","doi-asserted-by":"publisher","DOI":"10.3390\/s19143052"},{"key":"ref269","doi-asserted-by":"publisher","DOI":"10.1145\/1644893.1644899"},{"key":"ref270","article-title":"BotFlowMon: Identify social bot traffic with netflow and machine learning","author":"Feng","year":"2018"},{"key":"ref271","doi-asserted-by":"publisher","DOI":"10.1145\/2699026.2699119"},{"key":"ref272","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-02744-5_24"},{"key":"ref273","doi-asserted-by":"publisher","DOI":"10.1145\/2665943.2665950"},{"key":"ref274","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.3025988"},{"key":"ref275","first-page":"717","article-title":"Zero-delay lightweight defenses against Website fingerprinting","volume-title":"Proc. 29th USENIX Security Symp. (USENIX Security)","author":"Gong"},{"key":"ref276","first-page":"1","article-title":"Traffic morphing: An efficient defense against statistical traffic analysis","volume-title":"Proc. NDSS","volume":"9","author":"Wright"},{"key":"ref277","first-page":"1","article-title":"HTTPOS: Sealing information leaks with browser-side obfuscation of encrypted flows","volume-title":"Proc. NDSS","volume":"11","author":"Luo"},{"key":"ref278","doi-asserted-by":"publisher","DOI":"10.1515\/popets-2017-0023"},{"key":"ref279","doi-asserted-by":"publisher","DOI":"10.1109\/IHMSC.2017.132"},{"key":"ref280","doi-asserted-by":"publisher","DOI":"10.1145\/3419394.3423644"},{"key":"ref281","doi-asserted-by":"publisher","DOI":"10.5220\/0005740704070414"},{"key":"ref282","doi-asserted-by":"publisher","DOI":"10.1109\/NCCC49330.2021.9428874"},{"key":"ref283","volume-title":"Network-based Website fingerprinting","author":"Goldberg","year":"2019"},{"key":"ref284","volume-title":"New Tor release: Tor 0.4.0.5","year":"2019"},{"key":"ref285","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243832"},{"key":"ref286","doi-asserted-by":"publisher","DOI":"10.1145\/2665943.2665949"},{"key":"ref287","doi-asserted-by":"publisher","DOI":"10.1145\/3267323.3268960"},{"key":"ref288","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2020-0019"},{"key":"ref289","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484790"},{"key":"ref290","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2906228"},{"key":"ref291","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2022.107784"},{"key":"ref292","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.102150"},{"key":"ref293","doi-asserted-by":"publisher","DOI":"10.1080\/21642583.2018.1440260"},{"key":"ref294","doi-asserted-by":"publisher","DOI":"10.1109\/IWQoS49365.2020.9213026"},{"key":"ref295","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2019.09.024"},{"key":"ref296","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.052213.00046"},{"key":"ref297","first-page":"1","volume-title":"Standardizing Cyber Threat Intelligence Information With the Structured Threat Information Expression (STIX)","author":"Barnum","year":"2012"},{"key":"ref298","volume-title":"ChatGPT","year":"2023"},{"key":"ref299","doi-asserted-by":"publisher","DOI":"10.1109\/comst.2024.3504955"},{"key":"ref300","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484589"},{"key":"ref301","first-page":"4768","article-title":"A unified approach to interpreting model predictions","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"30","author":"Lundberg"},{"key":"ref302","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N16-3020"},{"key":"ref303","first-page":"1","article-title":"Model agnostic supervised local explanations","volume-title":"Proc. 32nd Conf. Adv. Neural Inf. Process. Syst.","volume":"31","author":"Plumb"},{"key":"ref304","doi-asserted-by":"publisher","DOI":"10.3389\/fdata.2021.688969"},{"key":"ref305","doi-asserted-by":"publisher","DOI":"10.1145\/3351095.3375624"},{"key":"ref306","doi-asserted-by":"publisher","DOI":"10.1109\/MPOT.2022.3198929"}],"container-title":["IEEE Communications Surveys & Tutorials"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/9739\/11303750\/10902364.pdf?arnumber=10902364","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,19]],"date-time":"2025-12-19T19:03:46Z","timestamp":1766171026000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10902364\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,12]]},"references-count":306,"journal-issue":{"issue":"6"},"URL":"https:\/\/doi.org\/10.1109\/comst.2025.3545541","relation":{},"ISSN":["1553-877X","2373-745X"],"issn-type":[{"value":"1553-877X","type":"electronic"},{"value":"2373-745X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,12]]}}}