PaperlayerView exact revision on arXiv

Source-linked AI summary

Explainable Rule Mining of IPv6 Extension-Header Presence Patterns from Paired-Vantage Captures

Priyanka Sinha, Nikolaos Kekatos, Stylianos Basagiannis, Antonio Anastasio Bruto da Costa, Alexios Lekidis, Pabitra Mitra, Tom Nianios, Elpiniki Papageorgiou

arXiv:2610.08090v1cs.CRcs.LGcs.NI

TL;DR

The paper addresses the need for human-readable descriptions of EH behavior from packet captures. It applies temporal-logic rule mining and evaluates whether its rules reflect cross-packet dynamics; on JAMES traces, the dominant Fragment-EH rule instead reflects within-packet co-occurrence.

  • Problem

    Operators need to know which EHs survive on which paths, while current answers rely on bespoke measurement scripts and readable rules must be checked for packet-construction artifacts.

    Source: §I · pp. 1–2

  • Method

    The paper applies PSIMiner to packet traces and uses negative controls and executed decision-tree and LLM baselines to test whether mined rules reflect cross-packet dynamics or within-packet co-occurrence.

    Source: §I · p. 2, A. Executed baseline: LLM rule-miner · p. 5, §VI · p. 6

  • Results

    Across all 21 JAMES receivers, the portable Fragment-EH rule at 87.4–98.9% is a within-packet, near-definitional co-occurrence, and two executed baselines converge on that explanation.

    Source: B. Mining at scale on JAMES receiver… · p. 3, A. Executed baseline: LLM rule-miner · p. 5, §VI · p. 6

  • Takeaways & Limitations

    On the evaluated JAMES traces, network-temporal structure does not carry the dominant Fragment-EH signal, and the negative-control protocol diagnoses whether a mined rule reflects cross-packet dynamics.

    Source: §VI · p. 6

    Evidence comes from a single controlled-probe corpus, and the authors leave external validity and generality beyond Fragment EH for future work.

    Source: A. Threats to validity · pp. 5–6

Abstract

from arXiv · show

IPv6 extension headers (EHs), such as fragmentation, segment routing, and in-situ telemetry, are operationally important yetwidely dropped in transit, and characterising their behaviour from packet captures is a recurring measurement problem. We ask whetheran explainable miner can recover human-readable rules of EH behaviour, and we contribute two reusable tools: a negative-control protocol that diagnoses whether a mined "temporal" network rule reflects genuine cross-packet dynamics or mere within-packetco-occurrence, and a sender-conditioned, per-family EH-retention measurement. Applying an interpretable temporal-logic rule miner to the JAMES paired-vantage dataset, we recover a portable Fragment-EH rule that the protocol reveals to be a within-packet,near-definitional co-occurrence rather than a temporal pattern, so the temporal-logic machinery does no work for this dominant rule;the retention measurement independently recovers the expected within-window ordering of EH observability. Our main result istherefore an honest, controlled negative finding, corroborated by executed decision-tree and large-language-model baselines: on theevaluated JAMES traces network-temporal structure does not carry the dominant Fragment-EH signal, and we supply the controls thatestablish when it would, validated on a synthetic positive control containing a genuine cross-packet dependency.

I. INTRODUCTION

IPv6 extension headers provide functions such as fragmentation, routing, telemetry, and security, but are often dropped in transit. The paper applies explainable rule mining to captured packets and introduces controls to distinguish genuine temporal behavior from within-packet co-occurrence.

I. INTRODUCTION

  • EHs add functions including fragmentation, source routing, telemetry, and IPsec security through a chain between IPv6's fixed header and data.Each header points to the next, so packet inspection must walk the chain.Source: §I · p. 1
  • Many intermediate devices silently drop EH-bearing packets, with observed rates varying by operator, EH type, and time.The paper frames this as a measurement problem and does not claim a security consequence its data do not show.Source: §I · p. 1
  • The paper seeks human-readable rules from packet captures that describe which packet features accompany EH presence or absence across measurement points.Such rules aim to replace bespoke, throw-away measurement scripts with explanations that also predict.Source: §I · p. 1
  • PSIMiner learns timed temporal-logic rules using only IPv6 fixed-header fields and EH-chain flags, keeping the learned rules directly readable from the header.The paper's negative-control protocol distinguishes genuine cross-packet dynamics from within-packet co-occurrence.Source: §I · p. 2
  • Across 21 JAMES receivers, the portable Fragment-EH rule reflects within-packet, near-definitional co-occurrence rather than a temporal pattern.The paper reports that two executed baselines reproduce this finding and presents sender-conditioned EH retention as a separate measurement.Source: §I · p. 2

II. METHODOLOGY

The methodology treats EH-presence analysis as specification mining over labelled packet traces. It uses a restricted, interpretable temporal-logic fragment in which the mined rule itself explains the target outcome.

II. METHODOLOGY

  • The restricted temporal-logic fragment expresses timed sequences of predicates with future intervals and conjunctions, preserving interpretable syntax while keeping mining tractable.It captures patterns such as event B occurring within a time interval after event A, including chained sequences with non-deterministic intervals.Source: §II · p. 2
  • PSIMiner learns candidate temporal rules whose antecedents match a target outcome often enough to be useful in the labelled traces.The mined rule is a global, human-readable property of the data rather than a post-hoc local saliency map.Source: §II · p. 2

A. Pipeline overview

The pipeline parses packet captures into attributed events, selects an EH-presence target, and mines rules with PSIMiner. Its trace representation is deliberately restricted to IPv6-header features and protocol-semantic predicates.

A. Pipeline overview

  • The pipeline parses each pcap into a timestamped CSV time series, selects a varying target such as HAS_FRAG_EH, and runs PSIMiner to produce explanatory rules.There is no post-hoc explainer or language model in the mining core.Source: A. Pipeline overview · p. 2

B. Trace representation

  • Each capture is projected onto a fixed per-packet schema using IPv6 fixed-header fields and Next-Header chain markers, excluding upper-layer and measurement-process facts.The relative timestamp is the first column.Source: B. Trace representation · p. 2
  • EH types receive separate binary predicates, while payload length, hop limit, and flow label use protocol-driven buckets rather than data-driven quantiles.The vocabulary contains no AS or vantage predicate, so the pipeline cannot produce AS- or provider-conditioned rules.Source: B. Trace representation · p. 2

C. Temporal pattern mining with PSIMiner

PSIMiner represents rules as timed sequences of predicate buckets and reports a correlation measure for each rule. The paper distinguishes this target-coverage measure from implication confidence and cautions against interpreting temporal association as intervention-based causation.

C. Temporal pattern mining with PSIMiner

  • PSIMiner's template places predicate buckets across intervals, allowing learned rules to express timed sequences leading to a target.The miner chooses predicates for buckets and may leave some buckets empty.Source: C. Temporal pattern mining with PSIMiner · p. 3
  • Its correlation score measures target coverage, approximately P(S | E), rather than implication confidence P(E | S).For Fragment EH, the passage gives P(PLEN_MED | HAS_FRAG_EH) = 1.00 but P(HAS_FRAG_EH | PLEN_MED) = 0.81, so coverage and confidence are reported separately.Source: C. Temporal pattern mining with PSIMiner · p. 3
  • The paper uses “causal” for temporal precedence plus statistical association, not intervention or counterfactual effects.Any causal reading rests on the measurement campaign's design, not on the mining algorithm.Source: C. Temporal pattern mining with PSIMiner · p. 3

D. Public datasets

The paper uses public IPv6 EH captures for pipeline sanity checks and applies its measurement-scale analysis to JAMES paired-vantage receiver captures. On JAMES, it reports one portable high-correlation rule that controls identify as within-packet.

D. Public datasets

  • The amwalding IPv6 EH pcap collection is a curated public set of pcapng fixtures spanning Hop-by-Hop, Fragmentation, Routing/SRv6, and ESP, with real byte-level layouts and 1–65 packets per file.It is used as a sanity substrate (§III-A).Source: D. Public datasets · p. 3
  • JAMES supplies paired-vantage IPv6 EH captures and experiment timestamps, enabling EH stripping to be observed across 21 vantage cities.Receiver captures contain approximately 35–40 thousand packets per vantage.Source: D. Public datasets · p. 3

III. RESULTS

  • On JAMES, the pipeline produces one portable high-correlation rule across receiver captures, which the controls identify as within-packet.The corpus provides 21 controlled Internet-wide vantage cities and paired-vantage observations.Source: §III · p. 3, D. Public datasets · p. 3
  • The paper reports mined rules in antecedent-to-consequent form and uses PSIMiner’s correlation as its data-fit metric.The results are based on JAMES; the amwalding substrate supports no measurement-scale conclusion.Source: §III · p. 3

A. Pipeline on the amwalding substrate

The small amwalding captures verify that the pipeline can parse public EH data, while JAMES supports measurement-scale mining. On JAMES, the same Fragment-EH rule appears across all 21 receiver vantages, but its apparent temporal interval reflects a near-definitional within-packet relation.

A. Pipeline on the amwalding substrate

B. Mining at scale on JAMES receiver pcaps

  • Across 21 JAMES vantages and 757,932 packets, the same Fragment-EH rule appears with correlation of 87.4–98.9%.The rule is !PLEN_MED |=> ##[0:4] !HAS_FRAG_EH.Source: B. Mining at scale on JAMES receiver… · p. 3
  • All 7,783 Fragment-EH packets at AMS have payload length at least 128 bytes, making !PLEN_MED ⇒ !HAS_FRAG_EH a near-definitional same-packet relation.The minimum observed payload is 458 bytes; JAMES generates Fragment probes at 512 bytes or larger.Source: B. Mining at scale on JAMES receiver… · p. 3
  • The ##[0:4] interval does no work for the dominant rule because the relevant payload and Fragment-EH properties hold on the same packet.Source: B. Mining at scale on JAMES receiver… · p. 3
  • Hop-by-Hop mining yields no rule above threshold; the EH is absent at all but Sydney, where 509 packets contain it, under 1.5% of traffic.The paper reports that this is consistent with JAMES identifying Hop-by-Hop as the most aggressively dropped category.Source: B. Mining at scale on JAMES receiver… · p. 3
  • Destination-Options and Routing rules reflect the schedule of testing one EH variant per window, so these temporal associations track the probe clock rather than network dynamics.Source: B. Mining at scale on JAMES receiver… · p. 3

IV. ROBUSTNESS, BASELINES, AND RETENTION

The robustness analyses distinguish within-packet association from order-dependent rules and test whether temporal structure adds signal. For the dominant Fragment-EH rule, permutation, complexity comparisons, and lagged-feature baselines support a controlled negative finding on network-temporal signal.

Joint-row permutation control

  • The headline within-packet rule remains invariant under joint-row permutation, while cross-EH rules can change sharply because the probe schedule blocks EH families in time.The fixed headline rule scores 100.0±0.00% across 20 permutations versus 97.2% ordered; a cross-EH rule changes from 42.3% to 99.6±0.08%.Source: §IV · p. 4

Independent-column shuffle

  • Independent-column shuffling destroys the within-packet HAS_FRAG_EH ↔ PLEN_MED association: size-to-fragment confidence falls from 0.806 to 0.200 ± 0.003, the base rate.PSIMiner returns no rule above threshold after the shuffles.Source: §IV · p. 4

Rule complexity vs. correlation

  • The strongest rule across six EH targets is single-bucket at 93.04%, while the best two-bucket rule reaches 24.8% and the best three-bucket rule 2.3%.No four-bucket rule scores above the two-bucket value.Source: §IV · p. 4

Positive control

  • A synthetic trace with a marker causing a target two packets later scores 99.99% ordered, then falls to the 59.0% base rate under permutation, validating detection of genuine cross-packet dependence.The JAMES order-dependent effects are measurement-temporal; the paper reports no network-temporal regime in these traces.Source: §IV · p. 4

Decision-tree cross-check

  • The AMS decision tree reaches 98.1% chronological test accuracy, and adding row-lagged features changes it to 0.978 at most, with no useful lagged-feature split.The reported stratified five-fold result is 96.9 ± 0.2%.Source: §IV · p. 4

One-dimensional hyperparameter ablation

  • The antecedent ¬PLEN_MED remains invariant across the ablation grid, and the mined interval upper bound equals seqLength × delayRes exactly.The interval is therefore hyperparameter-determined, not data-refined, on this corpus.Source: §IV · pp. 4–5, Table II · p. 5

PSIMiner crashes

  • The public PSIMiner 1.1 build crashes nondeterministically, but retries complete every ablation cell within one to three attempts, leaving no holes.The paper identifies a hardened build as future engineering work.Source: §IV · p. 5, Table II · p. 5

Cross-vantage bootstrap

  • The cross-vantage bootstrap gives a 95% interval of [93.60%, 96.08%] for the mean correlation across 21 JAMES receivers, not Internet vantage points or deployments.The reported mean is 94.86% with standard deviation 2.89.Source: §IV · p. 5

A. Executed baseline: LLM rule-miner

The paper executes an LLM rule-miner and checks its proposed rules with an independent validator. Its proposals converge on the within-packet payload-size/Fragment-EH link, while the validator rejects a plausible but poorly supported alternative.

Setup

  • The baseline uses a live model to propose rules and computes their correlations deterministically with an independent validator on the full trace.The numeric validation is reproducible from released artifacts, while free-text proposals can vary between runs.Source: A. Executed baseline: LLM rule-miner · p. 5

Findings

  • The LLM consistently proposes the polar inverse of PSIMiner’s rule at 100% coverage, but the confidence is only 0.81.The proposed relation reflects the within-packet plen ≥128 link, not an implication.Source: A. Executed baseline: LLM rule-miner · p. 5
  • The model also proposes a Destination-Options-to-Fragment rule that the validator rejects at 20.75% coverage.The paper attributes the poor fit to Destination-Options and Fragment probes running in disjoint windows.Source: A. Executed baseline: LLM rule-miner · p. 5
  • The LLM’s convergence on the same within-packet size-to-fragment link reinforces the negative finding, but these baselines are not a head-to-head benchmark.Accuracy and correlation/support are not a shared metric.Source: A. Executed baseline: LLM rule-miner · p. 5

B. Sender-window-conditioned retention

Sender-conditioned probe windows recover an EH-retention ordering consistent with prior JAMES observations, but the measurement is not packet-level survival analysis.

B. Sender-window-conditioned retention

  • 55.3% Destination Options, 47.4% Routing, 44.3% Fragment, and 0% Hop-by-Hop retention preserve the expected within-window ordering, each with lift >1.7.The apparent SENT_DST→RECV_FRAG transformation has lift 0.42, indicating none; IPv6 fragmentation is source-side, not in transit.Source: B. Sender-window-conditioned retention · p. 5
  • 36.6% of packets fell inside a probe window, so the measurement is reliable only at approximately 90-second family-block granularity, not per packet.Packets were not matched individually.Source: B. Sender-window-conditioned retention · p. 5
  • Adding SENT_* predicates leaves the within-packet rule !PLEN_MED |=> ##[0:4] !HAS_FRAG_EH dominant, with a 93.0% score; sender-label rules have 4.1% low correlation, negligible support, and no predictive lift.Source: B. Sender-window-conditioned retention · p. 5

V. DISCUSSION

The discussion qualifies the portable Fragment rule as a sender-imposed within-packet regularity rather than discovered temporal behavior, and bounds its generality to the evaluated corpus.

A. Threats to validity

  • The central rule’s 87–99% portability reflects a near-definitional, partly sender-imposed within-packet regularity, not a discovered temporal pattern.The corpus’s temporal axis is the JAMES probe clock.Source: A. Threats to validity · p. 5
  • Evidence comes from a single controlled-probe corpus, and the MAWI check found extension headers essentially absent from natural traffic.External validity and generality beyond Fragment remain future work.Source: A. Threats to validity · pp. 5–6
  • Mined rules report correlation under temporal precedence, not interventional causation.Any causal reading rests on the measurement campaign’s design, not the mining algorithm.Source: A. Threats to validity · p. 6

B. Related work and future directions

The paper distinguishes its controlled negative finding from prior provider-level observations and identifies broader survival measurement and external validation as future work. Its conclusion is that the dominant Fragment-EH signal in the evaluated JAMES traces is within-packet, not network-temporal.

B. Related work and future directions

  • Provider-level Routing-Header drop observations in the JAMES IETF draft motivate the work; they are not results of its AS-agnostic pipeline.The related-work discussion also distinguishes NetNomos [16] by its data-refined intervals versus this paper’s fixed window.Source: B. Related work and future directions · p. 6
  • A full sender-labelled survival campaign restricted to probe windows and hyperscaler EH testing are proposed to address measurement and coverage gaps.In the sampled MAWI trace, EHs were about 0.006% of IPv6 frames, making them vanishingly rare in that natural-backbone sample.Source: B. Related work and future directions · p. 6

VI. CONCLUSION

  • Across all 21 JAMES paired-vantage receivers, the portable Fragment-EH rule reaches 87.4–98.9%, but controls identify it as near-definitional within-packet co-occurrence rather than network-temporal structure.A decision tree and an executed LLM rule-miner independently reproduce the finding.Source: §VI · p. 6
  • The reusable negative-control protocol distinguishes genuine cross-packet dynamics from within-packet structure disguised as a temporal rule.Its controls include joint-row permutation, independent-column shuffle, and a lag-augmented tree.Source: §VI · p. 6
Loading 2610.08090v1…