Source-linked AI summary
A First Glance at Jev for Network Traffic Classification: Accuracy, Processing Time, and Cost
Shenghe Xu, Lifan Mei
TL;DR
Early traffic classification must identify applications despite encryption and delayed full-flow information, while numerical packet measurements do not explicitly state their relationship to application names. The study evaluates Jev on ten application labels using the first ten QUIC packets, comparing fixed labeled contexts with tree ensembles and a generative service. Forty examples improve Jev by 18.62 percentage points, but leave a 41.53-point gap to RF.
Problem
Early traffic classification must identify applications despite encryption and delayed full-flow information, while numerical packet measurements do not explicitly state their relationship to application names.
Source: §1 · pp. 1–2Method
The study evaluates Jev on ten application labels using the first ten QUIC packets, comparing fixed labeled contexts with tree ensembles and a generative service.
Source: §1 · p. 2, §3.2 · p. 4Results
Forty examples improve Jev by 18.62 percentage points, but leave a 41.53-point gap to RF.
Source: §4.1 · p. 5Takeaways & Limitations
On this ten-application numerical-prefix task, labeled context improves Jev, but its tested configurations do not match the accuracy of the trained ensembles.
Source: §6 · p. 8The unequal supervision budgets and absence of a matched-example tree control prevent estimating intrinsic label efficiency or attributing the accuracy gap to a single cause.
Source: §5 · p. 8
Abstract
from arXiv · showhide
We evaluate Jev on ten dataset-defined application labels in CESNET-QUICEXT-25 using only the first ten packets' sizes, directions, and inter-packet times. To the best of our knowledge, this is the first empirical study of general-purpose decision models, represented here by Jev, for application classification of network flows. Across 52,000 records from 26 collection weeks following the training period, 40 fixed labeled examples raise Jev's accuracy from 9.80% to 28.42%. Random Forest and Extra Trees trained on 8,000 records achieve 69.95% and 66.80% and outperform Jev in every week. Increasing Jev's context to 150 examples yields 34.50% on the first test week. On a paired 100-record subset, Jev with 40 examples achieves 29% accuracy at a median request time of 0.750 s, versus 37% and 6.036 s for the generative language model OpenAI GPT-5.6 Sol with high reasoning effort through Azure; Jev also incurs lower API charges. The paired subset does not establish an accuracy advantage for either service, and the timing reflects different service configurations. Thus, labeled examples substantially improve Jev, but the tested Jev configurations remain less accurate than trained tree ensembles; unequal supervision budgets and fixed configurations prevent attributing the gap to a single cause.
1 Introduction
The study asks whether a general-purpose decision service can classify early QUIC traffic from numerical packet measurements, and whether labeled examples make that approach useful in accuracy, processing time, and cost. Jev improves with context, but the trained ensembles remain more accurate across the test weeks.
1 Introduction
- Instructions and examples can describe a task to an existing model without weight updates [1], and networking research has begun exploring this possibility.The motivation is to use a shared model service rather than build a separate predictor for each task.Source: §1 · p. 1
- Early classification matters because encryption limits readable content and waiting for a complete flow delays identification; packet sizes, directions, and timings offer a compact alternative.The study asks whether small labeled contexts can adapt an existing service while preserving sufficient accuracy at acceptable processing time and cost.Source: §1 · p. 1
- Without domains or other identifiers, numerical bytes and time intervals do not state their relationship to application names, so task expressibility and classification competence require separate evaluation.The authors distinguish suitability for an instruction-based interface from the ability to solve the task using numerical traffic evidence.Source: §1 · pp. 1–2
- The study compares Jev’s typed decision interface with a generative service and supervised models on fixed numerical prefixes from ten applications, measuring accuracy, processing time, and cost.The generative comparison uses GPT-5.6 Sol through Azure; the later-period test is a closed-set classification task.Source: §1 · p. 2
- Across 26 later test weeks, Jev improves with labeled context, but Random Forest and Extra Trees retain an accuracy advantage; the paired service comparison favors Jev on time and charges, not established accuracy.The study presents this as the first empirical evaluation of general-purpose decision models for network-flow application classification.Source: §1 · p. 2
2 Background and Related Work
The background distinguishes decision interfaces and model adaptations while positioning this study as a comparison of services on shared numerical traffic prefixes. Prior systems and datasets motivate the setting but do not provide direct score baselines for this experiment.
2 Background and Related Work
- Jev exposes typed questions and candidate choices, while GPT-based services can return schema-constrained outputs; output format alone does not distinguish a useful classifier.The comparison concerns recorded service configurations, not inferred architectural speed, correctness, or calibration.Source: §2 · p. 2
- In-context examples communicate a task without parameter updates [1], but language understanding does not establish a mapping from packet measurements to application identities; NetLLM and TabPFN use specialized approaches.The study evaluates the simpler route of sending numerical prefixes to an unadapted service.Source: §2 · p. 2
- CESNET-QUICEXT-25 supplies longitudinal QUIC measurements, while ET-BERT [11] uses different representations and supervision, so its published scores are not numerical baselines here.The experiment compares methods on the same short numerical prefixes across later collection weeks.Source: §2 · p. 3
- Prior Jev work includes intrusion and attack-category detection, whereas this study classifies ten application labels from early QUIC packets and separates admissible output, correct classification, and useful time and cost.The study does not test internal weights, computation, or confidence calibration.Source: §2 · p. 3
3 Experimental Design
The experimental design uses a fixed longitudinal dataset, shared packet-prefix inputs, and recorded service configurations to compare tree ensembles and hosted decision services. It specifies data selection, context budgets, and operational measures, while noting that timing and cost reflect particular deployments.
3.1 Data and isolation
- The data are an archived CESNET DataZoo conversion checked against selected official records; labels are source-inherited, and each input contains ten packet triples of timing, direction, and payload size without identifiers.The 30 values are provided as channel-major vectors to trees and packet-major JSON triples to services.Source: §3.1 · p. 3
- Weeks are daily-file collection partitions, and a seeded hash selects up to 2,000 records per week after excluding previously selected IDs and exact prefix fingerprints; this does not establish disjoint hosts or connections.The selection is not class-balanced or prediction-dependent.Source: §3.1 · p. 3
3.2 Models and labeled context
- Random Forest and Extra Trees use fixed 500-tree configurations trained once on 8,000 records; Jev’s 40-example context uses four fixed examples per class, with no weight updates or test feedback.The week-5 Jev-150 extension retains the original 40 examples and adds records to reach 15 per class.Source: §3.2 · p. 4
- The paired generative baseline is GPT-5.6 Sol through Azure, using high reasoning effort and the same inputs, candidates, and examples as Jev, but a different API/output wrapper.The 100-record comparison is exploratory, uses serial requests, and is not an optimized LLM configuration search.Source: §3.2 · p. 4
3.3 Metrics and operational accounting
- Remote request time includes communication, network, gateway, and service processing but excludes packet observation; paired timing compares deployments with different service paths and execution patterns.Local time measures one warm-started prediction call, and neither timing includes observing the ten packets.Source: §3.3 · p. 4
- Accounting retains failures and retries, while Sol costs use conservative token rates rather than a verified invoice; local tree-ensemble hardware, energy, and labor are unpriced.Successful-attempt time excludes retry waits and does not measure first-attempt availability.Source: §3.3 · p. 4
- Accuracy uses the fixed planned denominator, and Table 1 reports the full test set with 100% final valid coverage; Figure 1 shows descriptive weekly accuracy trajectories on identical test records.The table caption notes that supervision budgets differ; the figure uses fixed models and context.Source: §3.3 · p. 4, Table 1 · p. 5, Figure 1 · p. 5
4 Results
Across the 52,000-record evaluation, labeled context improved Jev, but RF and ET remained ahead in every test week. More context improved week-5 accuracy, while the paired service comparison did not establish a stable accuracy winner.
4.1 Full-set accuracy and prediction behavior
- 40 examples improve Jev by 18.62 percentage points, but leave a 41.53-point gap to RF on the 52,000-record set.The training-majority constant reaches 22.79% accuracy; Jev-40 exceeds it by 5.62 points, while zero-shot Jev falls below it on both accuracy and macro-F1.Source: §4.1 · p. 5
4.2 Across collection weeks
- RF and ET remain above Jev-40 in all 26 test weeks, with no observed monotonic collapse or accuracy crossover.Their week-5-to-week-30 accuracies change from 72.70% to 69.50% for RF and from 70.00% to 64.85% for ET.Source: §4.2 · p. 5
4.3 More labeled examples
- On week 5, 150 examples raise Jev to 34.50% accuracy, 38.20 points below RF; three context sizes do not establish a scaling law.The comparison uses the same 2,000 records, while the RF/ET reference lines use 8,000 training records rather than equal label budgets.Source: §4.3 · p. 6, Figure 2 · p. 6
4.4 Paired generative-service comparison
- On the paired 100 records, Sol-40 correctly classifies 37 versus Jev-40’s 29, but the small-sample test establishes neither stable superiority nor equivalence.The services use different concurrency and service paths.Source: §4.4 · p. 6, Table 2 · p. 6
- The 40-example request medians differ by 5.29 s, a ratio of about 8.0; this compares service configurations, not architectural speedup.Figure 3 reports median successful processing time on the paired 100 records and notes that timing boundaries differ.Source: §4.4 · p. 6, Figure 3 · p. 7
4.5 Failures and cost
- Jev-0/40 report USD 0.002341/0.028234 for 100 paired successful responses, while Sol estimates USD 3.927254/5.613564 before failures and allowances.The conservative batch total is USD 36.4150; Sol’s estimates use budget rates, not an invoice.Source: §4.5 · p. 7, Table 3 · p. 7
5 Discussion and Limitations
Labeled context improves Jev but does not close the gap to trained ensembles, and the study cannot isolate why. The service comparison and broader conclusions are bounded by the tested configurations and evaluation scope.
Discussion and limitations
- Jev’s accuracy gains from labeled examples do not close its gap to trained ensembles, and this design cannot separate possible explanations for the remaining difference.The gap may reflect representation, example count and selection, service capability, or several factors together; the study compares practical configurations with unequal supervision budgets.Source: §5 · pp. 7–8
- The paired service comparison establishes a deployment-specific efficiency trade-off, not an accuracy advantage, real-time suitability, or architectural speed advantage.Timing and charges reflect different service configurations; packet-observation time, feature extraction, live deadline satisfaction, and local Jev inference were not measured.Source: §5 · p. 8
- Evidence from one network, ten classes, one weekly selection, and one fixed context family limits generalization to other settings.Chronological separation and weekly trajectories do not identify a causal drift mechanism or establish behavior in independent environments.Source: §5 · p. 8
- Results apply to the recorded model identifiers and execution date, and services and prices may change.Multiple example selections, independent networks, and lower-reasoning Sol settings are proposed tests, not completed evaluations.Source: §5 · p. 8
6 Conclusion and Future Work
On the studied ten-application numerical-prefix task, labeled context improves Jev, but RF/ET remain more accurate in every later collection week. Future work proposes tests of representations, supervision budgets, generality, and aligned service comparisons.
Conclusion
- Jev improves with labeled context, but RF/ET trained on 8,000 records remain more accurate in every later collection week.Jev’s shorter requests and lower charges than one high-reasoning Sol configuration show an operational trade-off, while the paired accuracy difference remains unresolved.Source: §6 · p. 8
Future work
- Future work proposes alternative representations and systematically selected examples, alongside matched-label-budget tree controls to clarify the role of supervision.These evaluations have not been run.Source: §6 · p. 8
- Independent networks and collection periods, plus service comparisons under aligned timing and cost conditions, are proposed to test generality and where decision services may be useful.These directions do not assume an advantage absent from the present results.Source: §6 · p. 8