TMorph: A Traffic Morphing Framework to Test Network Defenses Against Adversarial Attacks
Bibliographic record
Abstract
The increase in the Internet connectivity and the adoption of network-based services has resulted in unprecedented traffic volume. This increase results in new challenges for traffic classification in various areas including network traffic shaping, malicious traffic detection, and censoring illegitimate content. Traffic classification solutions are subject to evasion attacks from adversaries. Researchers and vendors need to assess how their systems behave against evasion attacks in this arms race. In this paper, we propose TMorph—an open source traffic morphing framework that efficiently simulates adversarial attacks and generates datasets for research and testing purposes. TMorph provides: broad support of network traffic morphing; ease of use for ordinary users to generate attack traffic with minimum commands or lines of code; and flexibility and extensibility so users can extend our framework easily to support more protocols and features. We present three case studies of utilizing TMorph to create encrypted malware traffic, apply encoding and obfuscation operations, and create tunnels for traffic effortlessly. We conduct performance measurements to show that TMorph can perform these operations with low CPU runtime and memory footprint. With evasion attacks on the rise, TMorph can assist researchers and vendors to build resilient network defenses.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame distilled prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. Learned from the 10,348 direct Codex labels and 10,348 direct Gemma labels. Candidate is the union of thresholded teacher heads; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels or direct frontier model labels.
Codex and Gemma teacher scores by category
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.001 | 0.000 |
| Meta-epidemiology (narrow) | 0.000 | 0.000 |
| Meta-epidemiology (broad) | 0.000 | 0.000 |
| Bibliometrics | 0.000 | 0.001 |
| Science and technology studies | 0.001 | 0.000 |
| Scholarly communication | 0.001 | 0.002 |
| Open science | 0.002 | 0.001 |
| Research integrity | 0.000 | 0.001 |
| Insufficient payload (model declined to judge) | 0.001 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one teacher head, not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".