ANT: A Multi-Granularity Network Traffic Dataset and Benchmark for Agents Behavior Auditing

• Agent behavior primitives can produce distinct traffic compositions, such as WebFetch traffic with DNS lookups and content downloads versus backend-dominated WebSearch traffic.Source: §1 · p. 2
• Existing traffic datasets lack annotations jointly covering agent risk, task scenarios, and execution stages, while AgentPrint lacks these joint labels.Source: §1 · p. 2
• ANT pairs agent traffic with task metadata and aligned behavior-primitive segments, then benchmarks risk identification, scenario recognition, and primitive classification.It contains 3,114 episodes across 20 tasks and five scenarios, with 276,417 flows and 40,049 primitive segments.Source: §1 · pp. 2–3
• Existing methods often miss malicious tasks resembling benign workflows, confuse scenarios with similar traffic patterns, and struggle with rare or semantically similar behavior groups.Source: §1 · p. 3

2.1 INFERRING AGENT BEHAVIOR FROM NETWORK TRAFFIC

• Prior work on encrypted traffic analyzes websites, applications, attacks, or conversation content, but does not jointly evaluate agent behavior at risk, scenario, and primitive granularities.Source: §2.1 · p. 3

2.2 THE NEED FOR A MULTI-GRANULARITY AGENT TRAFFIC DATASET

• Existing datasets lack synchronized agent executions and annotations for risk, scenarios, and behavior primitives; ANT aligns traffic with execution logs and provides common benchmark splits, objectives, and metrics.Source: §2.2 · p. 3

3 ANT DESIGN

• ANT contains 3,114 episodes across five scenarios and 20 tasks, with 276,417 bidirectional flows and 40,049 behavior-primitive segments in 47 macro groups.The collection also includes 659 task instances and 104.07 GB of traffic.Source: §3 · p. 3

3.1 DATA COLLECTION SYSTEM

• The task space covers four common agent-use scenarios and a high-risk cybersecurity-misuse scenario, with 17 benchmark-derived tasks in the common scenarios and three misuse tasks.Source: §3.1 · pp. 3–4
• The collection system records timestamped model calls, tool events, outputs, and session states while capturing packets, linking execution events to traffic for segmentation.Source: §3.1 · p. 4

3.2 BEHAVIOR PRIMITIVE ANNOTATION

• Packets are assigned to segments using primitive start times from session logs, and AI-derived labels describe local actions rather than only episode objectives.The 3,295 distinct labels are clustered into 47 macro groups using spherical K-means and iteratively reviewed.Source: §3.2 · pp. 4–5
• 15.46% smaller primitive-embedding MMD distances and 14.79% smaller Hellinger distances between macro-group proportions occur within scenarios than across scenarios.Both associations remain significant after Holm correction, with p = 0.0006 and p = 0.0050, respectively.Source: §3.2 · p. 5
• 6.74% and 5.70% distance reductions for semantic directed areas and macro-group transition residuals accompany additional order gains of 5.77 and 5.24 percentage points.Both order effects have Holm-adjusted p = 0.0050 and persist when role positions are fixed.Source: §3.2 · p. 5

4 BENCHMARK EVALUATION

• The benchmark tests episode-level risk identification and scenario recognition, plus segment-level classification into 47 primitive macro groups.It compares existing encrypted traffic classification and website fingerprinting methods and examines traffic scope and segment ablations for scenario recognition.Source: §4 · pp. 5–6

4.1 BASELINES AND EXPERIMENTAL SETUP

• The evaluation uses 13 traffic-analysis baselines, shared episode splits, and packet-header and sidechannel inputs with identifying IP addresses masked.Flow-based and episode-based methods use different input scopes; episode-level predictions aggregate flow predictions using a validation-selected strategy.Source: §4.1 · p. 6

4.2 RISK IDENTIFICATION RESULTS

• All 13 baselines exceed 90% accuracy, but more than half have recall below 50%; four record 0.000 detection for two abusive tasks while nearing 1.000 for web penetration.The affected tasks are malicious code generation and sandbox evasion; the figure reports malicious-task recall and benign-task specificity.Source: Table 3 · p. 7, §4.2 · p. 7, Figure 5 · p. 8

4.3 SCENARIO RECOGNITION RESULTS

• Across five scenarios, accuracy ranges from 0.431 to 0.727, and no baseline leads recall in all five; Evidence Assessment and Knowledge QA are frequently confused.Pooled predictions misclassify 35.1% of Evidence Assessment instances as Knowledge QA and 22.8% in the reverse direction. The scenarios share retrieval, inference, answer generation, and similar model-backend traffic shares, while baselines do not reliably exploit measured flow differences.Source: §4.3 · pp. 7–8
• Model calls alone raise average scenario accuracy by 5.56 percentage points, while removing them lowers it by 4.31; clearing representative segments lowers accuracy by 6.95 points versus 3.77 for nonrepresentative segments.Traffic without model calls still supports accuracies of 0.392–0.627, and the authors report that task-aligned primitive segments provide additional scenario clues.Source: §4.3 · p. 8

4.4 BEHAVIOR PRIMITIVE CLASSIFICATION RESULTS

• Primitive-classification accuracy ranges from 0.355 to 0.462, but predictions concentrate on frequent groups: the ten most frequent account for 72.44% of test segments and 91.34%–96.09% of correct predictions.This concentration persists despite upsampling rare groups to at least 200 training samples; groups with stable traffic patterns are also classified more reliably.Source: §4.4 · pp. 8–9
• Baselines also confuse semantically similar retrieval groups, including browser fetch and search, despite local traffic carrying predictive signals.For example, 37 of 204 browser fetch segments are predicted as search; search segments are also predicted as api query or browser fetch.Source: §4.4 · p. 9

5 DISCUSSION

• ANT pairs network traffic with semantic annotations and provides a common benchmark for agent behavior inference, transfer learning, and privacy defenses.The authors identify these auditing capabilities as dual-use because attackers could exploit them to infer private user activities.Source: §5 · p. 9
• The authors argue that studying these capabilities is important for understanding privacy exposure, developing defenses, and responsible oversight.This is their stated rationale despite the dual-use risk.Source: §5 · p. 9
• Coverage is constrained by financial and computational resources, AI annotation may be opaque or inaccurate, and controlled local collection may shift traffic timing from real deployments.The study mitigates annotation risks through repeated interaction, iterative review, and manual spot checks; controlled testbeds are also used in widely adopted traffic datasets.Source: §5 · p. 9

6 CONCLUSION

• ANT contains 3,114 episodes across 20 tasks and five scenarios, with 276,417 bidirectional flows and 40,049 primitive segments in 47 macro groups.The dataset also contains 104.07 GB of traffic.Source: §6 · pp. 9–10
• Existing methods capture distinctive traffic patterns but struggle with rare behaviors and semantic distinctions weakly reflected in traffic.ANT’s benchmark evaluates risk identification, scenario recognition, and behavior primitive classification.Source: §6 · p. 10
• ANT provides a foundation for more precise auditing and forensic analysis of agent behavior from network traffic.The released resources include packet-level traffic, collection and benchmark suites, and code.Source: §6 · p. 10, REPRODUCIBILITY STATEMENT · p. 10
• The authors report AI assistance with annotation, code development, calculations, related-work discovery, and language polishing, with human review and author responsibility.Section 3 describes collection and annotation; Section 4 presents benchmark objectives and evaluation, with split and hyperparameter details in Appendix D.2.Source: AI USE STATEMENT · p. 10, REPRODUCIBILITY STATEMENT · p. 10
• Collection used public benchmark tasks, avoided real-user accounts and private communications, simulated state-changing benign interactions, and isolated attack execution.Refusal-only episodes were excluded from the task-execution corpus.Source: ETHICS STATEMENT · p. 10
• The release includes sanitized execution logs, metadata, traffic traces, and annotations; data use CC BY 4.0 and code uses GPLv3.Third-party materials remain subject to their respective licenses, and the data license does not cover software code or third-party materials.Source: ETHICS STATEMENT · p. 10

A.1 SCENARIO AND TASK COMPOSITION

• Table 4 organizes ANT’s 20 tasks into the five scenarios used for scenario recognition.Its references identify source papers and versioned datasets or repositories where available.Source: Table 4 · p. 15

A.2 AGENT CONFIGURATIONS

• Table 5 specifies the agent software and backend model for each of ANT’s five collection configurations.Source: §A.2 · p. 16, Table 5 · p. 16

A.3 COLLECTION SERVER ENVIRONMENTS

• Traffic was collected on two Alibaba Cloud servers, whose hardware and operating systems are summarized in Table 6.Source: §A.3 · p. 16, Table 6 · p. 16

B.1 SEMANTIC ANNOTATION PROMPT

• The annotation prompt asks for each message’s high-level intent using content, tool calls, results, and surrounding task context rather than keyword matching.It requests concise retrospective behavior labels, neutral workflow primitives for non-security tasks, and exactly one JSON annotation per input message.Source: §B.1 · p. 17

B.2 PRIMITIVE MACRO GROUPS

• Table 7 lists canonical labels and split counts for 47 macro groups, including empty and unusable-TCP segments but excluding synthetic prelude segments.No training oversampling is applied to these counts.Source: §B.2 · p. 18, Table 7 · p. 18
• At K = 47, the cosine silhouette is approximately 0.157 and seed stability is approximately 0.51 ARI; the smallest macro group contains 14 primitive types.Figure 11 presents diagnostics across candidate K and marks partitions containing groups with fewer than 10 primitive types.Source: §B.2 · p. 19, Figure 11 · p. 19

C SCENARIO COHESION OF PRIMITIVE DISTRIBUTIONS AND SEQUENCES

• The scenario-cohesion analysis examines primitive structure through distributional cohesion and sequence organization beyond composition, using K = 47 and fixed Jina embeddings.Its comparisons average episode distances within task pairs, then weight scenarios and settings equally; positive gains indicate closer distances across different tasks within a scenario.Source: C SCENARIO COHESION OF PRIMITIVE… · p. 19

C.1 PRIMITIVE DISTRIBUTION COHESION

• The analysis compares primitive distributions in continuous semantic space and discrete category space; MMD bandwidth is selected independently of scenario labels, using 200,000 primitive-vector pairs and median nonzero squared distance σ2 = 0.9569.The analysis cohort contains 2,564 distinct primitive labels, a subset of the 3,295 distinct primitive labels in the full annotated corpus.Source: §C.1 · pp. 19–20
• 15.46% MMD cohesion gain indicates that different tasks within a scenario have more similar primitive embedding distributions.The analysis retains diagonal terms and takes the nonnegative square root for the exact empirical-measure distance.Source: §C.1 · p. 20
• 11.26% cohesion gain with 512 sliced-Wasserstein directions corroborates semantic distributional cohesion; gains were 11.17% with 1,024 directions and 11.62% with 256.The direction sets share a fixed prefix, and gains differed by 0.447 percentage points across budgets.Source: §C.1 · p. 20
• 14.79% Hellinger cohesion gain, alongside MMD’s corrected scenario-label test, supports cohesion in primitive category proportions as well as semantics.Hellinger distance accommodates zero frequencies; the MMD and Hellinger associations pass the corrected scenario-label tests.Source: §C.1 · p. 20, Table 8 · p. 21
• 0.7703 bits, or 34.86% of total empirical composition variation, is the scenario-associated component of primitive usage.The analysis uses an additive entropy decomposition across scenario, task, and episode levels.Source: §C.1 · p. 21

C.2 PRIMITIVE SEQUENCE STRUCTURE

• Second-level path signatures encode normalized sequence progress and semantic content, while their antisymmetric component retains directional ordering information.With composition fixed, the endpoint—and therefore the symmetric part—is fixed; pairwise semantic coordinates capture relative ordering.Source: §C.2 · p. 21
• Aggregate gains are 6.74% for directed area and 5.70% for transition residuals, with Holm-adjusted p = 0.0182 for both scenario-association tests.Directed area describes semantic ordering; transition residuals describe primitive macro-group organization.Source: §C.2 · p. 22
• Within-episode position permutations preserve each primitive multiset and episode length, providing a reference that retains composition-dependent variability.The comparison recomputes sequence representations, distances, and aggregate gains across 999 trials.Source: §C.2 · p. 22
• Directed area and transition residuals add 5.77 and 5.24 percentage points over randomized references, respectively; both additional-order tests have Holm-adjusted p = 0.0050.The gains remain positive and significant when role positions are preserved and permutations occur only within the same role.Source: §C.2 · p. 22

D.1.1 ENCRYPTED TRAFFIC CLASSIFICATION •

• The benchmark evaluates five encrypted traffic classification baselines spanning compact flow markers, packet-byte representations, sequential models, and combined packet, flow, and host features.FlowLens uses packet-size and inter-packet-time distributions; YaTC uses hierarchical flow matrices and packet- and flow-level attention; other descriptions include Mamba, feature fusion, and Transformer models.Source: §D.1 · p. 22, §D.1.1 · pp. 22–23

D.1.2 WEBSITE FINGERPRINTING •

• Eight website fingerprinting baselines cover deep CNNs, packet-sequence models, timing-aware models, contrastive learning, and multi-tab recognition approaches.The listed methods include DF, AWF, Tik-Tok, Var-CNN, NetCLR, TMWF, ARES, and BAPM.Source: §D.1.2 · p. 23

D.2 EXPERIMENT CONFIGURATION

• The test set contains 209 episodes—189 benign and 20 malicious—and primitive evaluation covers 2,101 test segments before oversampling.Primitive segments inherit their source episode’s split; the test-set scenario counts are 35, 72, 60, 22, and 20 in Section 3.1 order.Source: §D.2 · p. 23
• Risk and scenario identification use two and five classes at the episode level, while primitive identification uses 47 macro groups at the segment level.Table 11 summarizes the configurations for the three identification tasks.Source: §D.2 · p. 23, Table 11 · p. 24
• Primitive training classes with fewer than 200 segments are oversampled to 200 by replacement, while validation and test distributions remain unchanged.WF models use packet sequences truncated or zero-padded to configured lengths; ARES uses 20 ms bins, and TMWF risk inputs retain the first 10,000 packets.Source: §D.2 · p. 24
• Model configurations differ by baseline, including pretrained fine-tuning, contrastive encoder training, random forests, and task-specific sequence lengths and learning rates.TFusion’s scenario classifier freezes an encoder trained on benign ANT flows; its risk encoder is trained contrastively on benign flows before random-forest classification.Source: §D.2 · p. 24
• Episode-level predictions use validation-accuracy-selected aggregation for encrypted traffic classification, with task-specific averaging or majority voting across baselines.Scenario probabilities are averaged within episodes; risk uses the same aggregation for FlowLens and YaTC, and majority voting for NetMamba, TFusion, and TrafficFormer.Source: §D.2 · p. 24