Matched-View Cross-Domain Evaluation of WireGuard VPN Traffic Classification

Code accompanying the paper "Matched-View Cross-Domain Evaluation of WireGuard VPN Traffic Classification Using Early-Flow Fingerprints" (CNSM 2026).

This repository contains the full preprocessing, training, evaluation, and plotting pipeline used in the paper.

Notebooks

• 00_preprocessing.ipynb — builds the FlowFeatures and SPLT representations from the dataset
• 01_CrossDomain_CNN1D_SPLT.ipynb — multi-scale CNN1D on SPLT (cross-domain transfer)
• 02_CrossDomain_RF_XGB_SPLT.ipynb — Random Forest / XGBoost on flattened SPLT (cross-domain transfer)
• 03_CrossDomain_RF_XGB_FlowFeatures.ipynb — Random Forest / XGBoost on FlowFeatures (cross-domain transfer)
• 04_Graphical_Results.ipynb — figures and tables reported in the paper

Reproduction

Run the notebooks in order:

1. 00_preprocessing.ipynb — builds the FlowFeatures and SPLT tensors used by all model notebooks.
2. 01–03 — train and evaluate each model/representation under the matched-view cross-domain protocol (train on the non-VPN view, test on the matched VPN view of the same flows). Each notebook writes its metrics, trained model, predictions, and per-model diagnostic plots to the corresponding results_* folder.
3. 04_Graphical_Results.ipynb — reads the per-model outputs from results_01– results_03 and produces the figures reported in the paper.

The dataset is not bundled: download it first (see Dataset) and place it under dataset/. Trained-model binaries and large prediction dumps are not committed — they are regenerated by re-running the notebooks — while all figures and summary metrics are included, so the results can be inspected without re-running anything.

Repository outputs

Each results_* folder holds the committed figures, metrics, reports, and bootstrap confidence intervals for the corresponding notebook. Beyond the figures used in the paper, the repository includes complementary analyses that did not fit the page limit:

• results_01_CrossDomain_CNN1D_SPLT/ — CNN1D metrics, bootstrap CIs, confusion matrix, and additional training curves, class-distribution, and bootstrap-distribution plots.
• results_02_CrossDomain_RF_XGB_SPLT/ — RF and XGBoost (flattened SPLT) metrics, bootstrap CIs, confusion matrices, plus feature-importance (RF) and SHAP top-20 (XGBoost) attributions.
• results_03_CrossDomain_RF_XGB_FlowFeatures/ — RF and XGBoost (FlowFeatures) metrics, bootstrap CIs, confusion matrices, plus feature-importance and SHAP top-20 attributions.
• results_04_Graphical_Results/ — the paper figures (per-class F1 interaction, top confused pairs, macro precision–recall curves) plus additional confusion-matrix analyses (CNN1D confusion matrix, cross-model Chat/VoIP comparison, and the union confused submatrix), in both PNG and PDF.

Dataset

The matched-capture WireGuard dataset is described in the accompanying Data in Brief data article and archived on Zenodo:

• Data article: Y. S. Razooqi and A. Pekar, "A flow-level dataset of WireGuard tunnel traffic with matched encrypted-side features and application labels," Data in Brief, vol. 66, p. 112696, 2026. doi: 10.1016/j.dib.2026.112696
• Dataset archive (Zenodo): 10.5281/zenodo.18945858

Obtain the dataset from the links above and place it under dataset/ to run the notebooks.

Authors

Yasameen Sajid Razooqi and Adrian Pekar — FlowFrontiers Research Group, Department of Networked Systems and Services, Budapest University of Technology and Economics.