Symbolic Flow Representation Based on the First-M Packets for Early Traffic Classification - Fernandes, Marcelo A. C. (Anais do Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos (SBRC), 2026)
This paper presents a symbolic flow-level representation for early network traffic classification based on the first M packets of a bidirectional flow. Each packet payload is converted into a symbolic token sequence and embedded using a transformer-based sentence embedding model, followed by flow-level aggregation. The resulting embeddings are evaluated using XGBoost for binary VPN mode classification and multiclass traffic-type classification. Experiments are conducted on the ISCX VPN-nonVPN dataset using repeated balanced holdout validation. Results show that the proposed representation enables accurate discrimination between VPN and non-VPN traffic and supports traffic-type identification under both VPN and non-VPN settings.