PaperlayerView exact revision on arXiv

Source-linked AI summary

From Ethernet to Wi-Fi: Flow Feature Selection and Construction for Traffic Classification

Francisco Rau, Petia Georgieva, Carlos Herranz, Iñaki Val, Joaquin Perez

arXiv:2610.37007v1cs.NIcs.LG

TL;DR

Ethernet-trained flow classifiers may lose accuracy on Wi-Fi because wireless contention and network load can change packet timing and feature distributions. A five-stage procedure selects and constructs features from Ethernet-trained models, reducing the initial 29-dimensional space to seven representative packet-size and timing inputs. In ns-3 simulations, the compact feature space improved accuracy on the held-out Wi-Fi scenario (S7) from about 88% to about 99.9%.

  • Problem

    Ethernet-trained flow classifiers may lose accuracy on Wi-Fi because wireless contention and network load can change packet timing and feature distributions.

    Source: §I · p. 1

  • Method

    A five-stage procedure selects and constructs features from Ethernet-trained models, reducing the initial 29-dimensional space to seven representative packet-size and timing inputs.

    Source: §I · p. 1, 5) Feature Construction · p. 3

  • Results

    In ns-3 simulations, the compact feature space improved accuracy on the held-out Wi-Fi scenario (S7) from about 88% to about 99.9%.

    Source: §V · p. 5

  • Takeaways & Limitations

    Careful feature selection and construction can help Ethernet-trained models transfer to Wi-Fi without using Wi-Fi data for classifier training.

    Source: §V · p. 5

    Future work will evaluate feature suitability under different traffic loads, streaming implementations, and real network conditions.

    Source: §V · p. 5

Abstract

from arXiv · show

Flow-based traffic classifiers trained on Ethernet data may lose accuracy when applied to Wi-Fi traffic. This paper proposes a five-stage procedure for selecting and constructing features that enable Wi-Fi flow classification using models trained only on Ethernet data. The procedure removes the transport protocol identifier, examines rate dependence, compares feature distributions and the information each feature provides for the application classes, reduces redundancy, and constructs normalized packet-size and temporal features. Ethernet and Wi-Fi traffic are simulated in ns-3, with Wi-Fi using Best Effort access category. Labelled Wi-Fi data from six development scenarios are used for feature design, while a separate scenario is reserved for final testing. The evaluation compares feature sets, examines threshold sensitivity, and analyses classification errors under different traffic conditions.

I. INTRODUCTION

Ethernet-trained flow classifiers may lose accuracy on Wi-Fi as contention and network load alter timing and feature distributions. The paper studies feature selection and construction for transfer across the two media using controlled ns-3 simulations.

I. INTRODUCTION

  • Wi-Fi contention and network load can change packet timing and feature distributions, making Ethernet-trained classifiers potentially less accurate on Wi-Fi.Collecting labelled traffic under different congested Wi-Fi conditions in real networks is costly, motivating controlled ns-3 simulations.Source: §I · p. 1
  • A five-stage procedure selects and constructs features for Wi-Fi classification using models trained only on Ethernet data.The initial 29-dimensional feature space is reduced to seven inputs using labelled Wi-Fi data from six development scenarios; a separate scenario is reserved for final evaluation.Source: §I · p. 1

A. Data Processing

  • Flow features use packet metadata in five-second windows advanced every second, with TCP statistics including reverse-direction acknowledgments and UDP statistics using downlink packets.Packets without IP payload are discarded, while pure TCP acknowledgments are retained because they contain TCP headers.Source: A. Data Processing · p. 1
  • The AP-side classifier targets downlink application flows forwarded by the home BSS 1 access point, while excluding uplink application traffic.The eight classes are common to Ethernet and Wi-Fi and include VoIP and DASH video streaming.Source: A. Data Processing · p. 1

B. Feature Selection and Construction

The procedure reduces the original feature set in stages, beginning by excluding transport protocol identity. The first four stages apply fixed selection rules; the fifth constructs normalized size and temporal features.

B. Feature Selection and Construction

  • The first four fixed-rule stages reduce the 29 original features to 28, 16, 12, and nine, before construction yields seven final features.The final features are normalized size and temporal features.Source: B. Feature Selection and Construction · p. 1

1) Transport Exclusion:

  • Removing the transport identifier prevents direct use of TCP or UDP identity and leaves 28 candidate features.Table I is titled as listing common application classes and dataset windows.Source: 1) Transport Exclusion · p. 1, Table I · p. 2

2) Rate Dependence:

The procedure first filters rate-dependent features, then compares feature distribution shift and class information across Ethernet and Wi-Fi. These stages reduce the candidates while applying explicit rate, KS-distance, and MI-ratio criteria.

2) Rate Dependence:

  • Twelve features with rate-dependence scores s(X) ≥0.97 are removed, including packet and byte counts, TCP flag count, rate descriptors, and related volume measures.The score is the largest absolute Pearson correlation with traffic rate among four variable-rate applications; using measured throughput or configured rate yields the same exclusions.Source: 2) Rate Dependence · p. 2

3) Distribution Shift and Class Information:

  • The distribution-shift and class-information plot marks retained and removed features against KS distance 0.30 and MI-ratio thresholds 0.60 and 1.00.The KS distance is label-independent, while MI estimates how much a feature contains information about application labels.Source: Figure 1 · p. 2, 3) Distribution Shift and Class… · p. 2
  • The criteria remove avg_min_pkt_size, mean_iat, std_iat, and directions, leaving 12 features.The MI ratio compares estimated feature information on Wi-Fi with that on Ethernet; the evaluation uses 1,728 balanced Ethernet windows and 10,718 Wi-Fi windows from S1–S6, whose mixes, loads, and contention vary.Source: 3) Distribution Shift and Class… · p. 2

4) Redundancy Reduction:

Redundancy reduction prunes correlated features in Ethernet training data, leaving nine inputs. Feature construction then retains three statistics and adds four ratios to form the final seven-feature set.

4) Redundancy Reduction:

  • Correlated-feature pruning retains max_pkt_size, rms_pkt_size, and max_iat over their correlated alternatives, leaving nine features.Candidates are considered in increasing distribution distance; the pruning correlation threshold is 0.98 in Ethernet training.Source: 4) Redundancy Reduction · p. 2

5) Feature Construction:

  • The final seven-feature set retains rms_pkt_size, max_pkt_size, and switching_ratio, then constructs four ratio features from remaining statistics.The seven inputs require nine statistics, including the two means used as denominators.Source: 5) Feature Construction · pp. 2–3
  • Constructed size ratios have lower linear rate correlation than their original statistics, while their rank correlations are at least 0.978 in both media.Timing ratios express gaps relative to observed duration or mean gap; activation_fraction decreases when the longest gap occupies more of the observed span.Source: 5) Feature Construction · p. 2
  • The feature-space table defines seven classifier inputs from nine statistics, with zero denominators replaced by 10^-9.The two means excluded as inputs supply denominators; switching_ratio measures the fraction of consecutive packets with different sizes.Source: 5) Feature Construction · p. 3, Table III · p. 3

A. Ethernet Datasets

The study evaluates Ethernet training and test data alongside Wi-Fi simulations across development and held-out scenarios. The Wi-Fi setup varies network conditions and application flows, with five runs per scenario.

A. Ethernet Datasets

  • The Ethernet dataset uses an uncongested 1 Gb/s ns-3 link; IPERF TCP training uses four rates and testing also includes an unbounded rate.The balanced test set comes from separate simulation-seed captures and includes rates absent from training.Source: A. Ethernet Datasets · p. 3
  • Rate-dependence analysis adds 348 Ethernet windows, including variable-rate applications and fixed-rate Gaming, VoIP, and Video Streaming.DASH's configured rate represents its video profile, while its segments download in bursts.Source: A. Ethernet Datasets · p. 3

B. Wi-Fi Simulation Scenarios

  • Wi-Fi simulations use 802.11be EHT at 5 GHz, with all application flows assigned the Best Effort access category.Runs last 60 seconds, and applications start at 2 seconds.Source: B. Wi-Fi Simulation Scenarios · p. 3
  • S3–S6 add eight 70 Mb/s UDP uplink flows from a neighboring co-channel BSS, while S7 sends nine downlink flows to separate stations.S7 includes uplink traffic from its Video Conference, VoIP, and Gaming applications.Source: B. Wi-Fi Simulation Scenarios · p. 3
  • Each Wi-Fi scenario has five simulation-seed runs; S1–S6 include 30 runs and 10,718 evaluated windows from 40 downlink flows.The 10,718 windows are 82 below the 10,800 maximum because congestion leaves some flows incomplete; S7 follows the same procedure.Source: B. Wi-Fi Simulation Scenarios · p. 3

C. Implementation and Evaluation Protocol

The evaluation holds the XGBoost model settings constant while comparing successive feature sets on Ethernet and Wi-Fi data. The seven-feature set gives the Wi-Fi sets their highest accuracy, while each selection stage reveals specific errors or trade-offs.

C. Implementation and Evaluation Protocol

  • The same XGBoost hyperparameters train six models on 29, 28, 16, 12, nine, and seven features, using Ethernet training windows only.Grid search and four-fold cross-validation use four Ethernet captures; a fifth capture is reserved for Ethernet testing.Source: C. Implementation and Evaluation… · p. 3
  • S1–S6 guide feature design but not model training, while S7 is excluded from design and reserved as the held-out Wi-Fi test scenario.Development metrics pool 10,718 windows; S7 accuracy is averaged over five runs of 486 windows each.Source: C. Implementation and Evaluation… · p. 3

A. Effect of the Selection and Construction Stages

  • Removing protocol leaves S1–S6 accuracy unchanged because the TCP flag count still distinguishes TCP from UDP.With 29 features, 932 Video Streaming windows are classified as IPERF TCP and 266 Bulk TCP windows as Video Streaming; the 28-feature results are similar.Source: A. Effect of the Selection and… · p. 3
  • The rate-dependence filter removes the TCP flag count and lowers accuracy on Ethernet test, S1–S6, and S7.In S1–S6, 3,092 Video Conference, IPERF UDP, and Bursty UDP windows are classified as IPERF TCP; higher-rate UDP and S7 Video Conference traffic have mean inter-arrival times within the IPERF TCP training range.Source: A. Effect of the Selection and… · pp. 3–4
  • The KS and MI criteria remove four features and restore correct classification of the affected UDP flows, but redundancy reduction misclassifies all 540 windows of 300 Mb/s Bursty UDP as IPERF UDP.Those flows have constant 1,474-byte packets at 40 µs intervals; adding mean_pkt_size back restores correct classification. The Wi-Fi scenario table describes downlink flow rates by application ID.Source: A. Effect of the Selection and… · p. 4, Table IV · p. 4
  • With seven inputs, Bursty UDP is classified correctly and both Wi-Fi sets reach their highest accuracy across the compared feature sets.Feature construction retains three direct statistics and introduces four ratio-based features.Source: A. Effect of the Selection and… · p. 4, Figure 2 · p. 4

B. Sensitivity to Selection Thresholds

The selected nine raw features remain unchanged across the tested individual and joint threshold variations. These tests support stability within the evaluated ranges, not global optimality.

B. Sensitivity to Selection Thresholds

  • Varying each threshold separately across the tested ranges retains the same nine raw features.The selected thresholds are 0.97 for rate correlation, 0.30 for KS distance, 1.00 and 0.60 for the MI criteria, and 0.98 for redundancy correlation.Source: B. Sensitivity to Selection Thresholds · p. 4
  • The chosen rate-correlation threshold, 0.97, lies near the upper end of its tested range, 0.8326–0.9712.Source: B. Sensitivity to Selection Thresholds · p. 4
  • Joint variation tests one representative from each of 39,600 threshold regions, and all retain the same nine raw features.Results are also unchanged across ten MI-estimator seeds; this establishes stability within tested ranges, not global optimality.Source: B. Sensitivity to Selection Thresholds · p. 4

C. Classification Errors on S1–S6

With seven features, nearly all Video Streaming windows are correct, but many IPERF TCP windows are mistaken for Video Streaming; the class imbalance raises overall accuracy despite lower IPERF TCP recall. Earlier feature sets also confuse Video Streaming and IPERF TCP as their timing patterns converge on Wi-Fi.

C. Classification Errors on S1–S6

  • 38.9% IPERF TCP recall with seven features accompanies 165 IPERF TCP and ten Bulk TCP windows classified as Video Streaming.Table V is identified as reporting per-class recall, accuracy, and macro-F1 for 29 and seven features; its cell values are not supplied.Source: C. Classification Errors on S1–S6 · p. 4, Table V · p. 4
  • About half of Video Streaming windows are labeled IPERF TCP with 29-to-12-feature sets, as both classes’ Wi-Fi windows approach five-second durations.Ethernet training windows differ in duration: IPERF TCP spans five seconds, while Video Streaming windows are shorter.Source: C. Classification Errors on S1–S6 · p. 4
  • Nearly all Video Streaming windows are correct with seven features, but many IPERF TCP windows are mislabeled; roughly sevenfold more Video Streaming windows raise accuracy despite lower IPERF TCP recall.S1–S6 metrics pool windows across 30 runs, so the larger class contributes more to overall accuracy.Source: C. Classification Errors on S1–S6 · p. 4
  • In S2, similar packet sizes and load-driven timing convergence make IPERF TCP and Video Streaming harder to distinguish; nearly all IPERF TCP windows below 0.98 activation_fraction are labeled Video Streaming.In Ethernet training, IPERF TCP activation_fraction is at least 0.9996, while Video Streaming is at most 0.68.Source: C. Classification Errors on S1–S6 · pp. 4–5

D. Results on Test Scenario S7

On held-out S7, only two IPERF TCP windows are misclassified, while seven constructed features correctly classify every Bulk TCP window. The results also identify limits tied to the simulated traffic and streaming setup.

D. Results on Test Scenario S7

  • Only two S7 windows are misclassified, both as Video Streaming; they are startup windows with activation_fraction below 0.98.Both are the first two IPERF TCP windows from one run.Source: D. Results on Test Scenario S7 · p. 5
  • All 270 Bulk TCP windows are labeled IPERF TCP with 29 features, and most errors persist through 16, 12, and nine features.The longest gap falls from 1.2 ms in training to 0.24 ms in S7, close to IPERF TCP’s 0.22 ms training value.Source: D. Results on Test Scenario S7 · p. 5
  • Seven constructed features classify all Bulk TCP windows correctly, unlike the evaluated models before feature construction.Bulk TCP’s maximum packet size is 1,475 bytes, versus at most 592 bytes for IPERF TCP and Video Streaming; size and switching features outweigh activation_fraction.Source: D. Results on Test Scenario S7 · p. 5
  • Evaluation uses one simulated DASH client and specific traffic generators, limiting generalization to other implementations and conditions.Adaptive video can vary chunking, segment size, bitrate, and timing with load and playback state.Source: D. Results on Test Scenario S7 · p. 5

V. CONCLUSION

The conclusion is that careful feature selection and construction can help Ethernet-trained classifiers transfer to Wi-Fi without Wi-Fi classifier-training data. In ns-3 simulations, the compact feature space improved held-out Wi-Fi accuracy while Ethernet accuracy remained high.

V. CONCLUSION

  • About 88% to about 99.9%: the seven-feature space improves accuracy on held-out Wi-Fi scenario S7, while Ethernet accuracy remains about 99.5%.The conclusion attributes the transfer result to careful feature selection and construction without Wi-Fi data for classifier training.Source: §V · p. 5
  • Future work will test whether the selected features remain suitable under different traffic loads, streaming implementations, and real network conditions.The study’s simulations use one DASH client and specific traffic generators.Source: §V · p. 5
Loading 2610.37007v1…