An investigation on identifying SSL traffic
Why this work is in the frame
A frame that forgets how it found something cannot be audited. These are the routes that admitted this work.
Bibliographic record
Abstract
The importance of knowing what type of traffic is flowing through a network is paramount to its success. Traffic engineering, quality of service, identifying critical business applications, intrusion detection systems, as well as network management activities all require the base knowledge of what traffic is flowing over a network before any further steps can be taken. With Secure Socket Layer (SSL) traffic on the rise due to applications securing or concealing their traffic via encryption, the ability to determine what applications are running within a network is getting more and more difficult. Traditional methods of traffic classification through port numbers and deep packet inspection tools have been deemed inadequate despite their continued popular usage. The purpose of this work is to investigate if a machine learning approach can be used with flow features to identify SSL traffic in a given network trace. To this end, different machine learning methods, namely AdaBoost, C4.5, RIPPER, and Naive Bayesian techniques, are investigated without the use of port numbers, Internet Protocol addresses, or payload information.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
Full frame distilled prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. Learned from the 10,348 direct Codex labels and 10,348 direct Gemma labels. Candidate is the union of thresholded teacher heads; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels or direct frontier model labels.
Codex and Gemma teacher scores by category
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.000 | 0.000 |
| Meta-epidemiology (narrow) | 0.000 | 0.000 |
| Meta-epidemiology (broad) | 0.000 | 0.000 |
| Bibliometrics | 0.000 | 0.000 |
| Science and technology studies | 0.000 | 0.000 |
| Scholarly communication | 0.000 | 0.001 |
| Open science | 0.001 | 0.000 |
| Research integrity | 0.000 | 0.000 |
| Insufficient payload (model declined to judge) | 0.000 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from it