Real-Time Network Traffic Classification — Reproduction Package

Companion code and data for the paper:

From Packets to Tokens: A Pure Transformer Framework for Real-Time Network Traffic Classification

This repository contains everything needed to reproduce all tables and figures in the paper, as well as the live-capture scripts used in the real-time experiments.

---

Repository Structure

Real-Time Experiments/
├── Paper_Tables_and_Figures/   # One folder per table/figure in the paper
│   ├── Table_1_Dataset_Stats/
│   ├── Table_2_Preprocessing_Search/
│   ├── Table_3_Hyperparameter_Tuning/
│   ├── Table_4_PerClass_Performance/
│   ├── Table_5_RealTime_InDistribution/
│   ├── Table_6_OOD_Generalization/
│   ├── Figure_4_Confusion_Matrix/
│   ├── Figures_1_2_3_Workflow_Diagrams/
│   └── Baseline_Comparison/
├── model/                      # Pre-trained Transformer weights
│   └── best_model_weights.obj
├── offline_training/           # Grid search results from offline experiments
│   ├── Transformer/
│   ├── LSTM/
│   └── preprocessing/
├── results/                    # Per-class raw results from live captures
├── scripts/                    # Live capture and inference scripts
│   ├── run_experiment.sh
│   ├── rt_experiment.py
│   └── rtp_simulate.py
└── documentation/
    └── experiment_guide.pdf    # Full mapping of tables/figures to code and data

---

Quick Start — Reproducing a Table

Each folder under Paper_Tables_and_Figures/ contains a self-contained Python script and the data it needs. To reproduce any table, run the corresponding script:

# Table 1 — Dataset statistics
python3 Paper_Tables_and_Figures/Table_1_Dataset_Stats/table1_info.py

# Table 2 — Preprocessing search space and best values
python3 Paper_Tables_and_Figures/Table_2_Preprocessing_Search/table2_preprocessing_search.py

# Table 3 — Hyperparameter tuning results
python3 Paper_Tables_and_Figures/Table_3_Hyperparameter_Tuning/table3_hyperparameter_tuning.py

# Table 4 — Per-class sensitivity and specificity
python3 Paper_Tables_and_Figures/Table_4_PerClass_Performance/table4_perclass_performance.py

# Table 5 — Real-time in-distribution results
python3 Paper_Tables_and_Figures/Table_5_RealTime_InDistribution/table5_realtime_indistribution.py

# Table 6 — Cross-application (OOD) generalization results
python3 Paper_Tables_and_Figures/Table_6_OOD_Generalization/table6_ood_generalization.py

# Baseline comparison (Transformer vs LSTM vs Maitin et al.)
python3 Paper_Tables_and_Figures/Baseline_Comparison/baseline_comparison.py

---

Real-Time Capture (Tables 5 & 6)

The live-capture experiment captures 8-second traffic windows via TShark, preprocesses them through the nt2txt pipeline, and classifies them with the Transformer model.

Requirements: TShark installed and accessible, WiFi interface available (macOS: en0).

# Capture 10 windows for a given class and run number
bash scripts/run_experiment.sh <Class> <RunNumber>

# Example: in-distribution Chat, run 4
bash scripts/run_experiment.sh Chat 4

# Example: OOD VoIP (Google Meet), run 7
bash scripts/run_experiment.sh VoIP 7

Results are appended to results/results_log.csv after each window.

VoIP simulation (for in-distribution VoIP traffic generation):

python3 scripts/rtp_simulate.py

---

Model

The pre-trained Transformer weights are stored in model/best_model_weights.obj.

Parameter	Value
Attention heads	8
Head size	6
Feed-forward dim	256
MLP units	250
Dropout	0.2
Attention layers	1
Positional encoding	No
Parameters	149,464

---

Documentation

documentation/experiment_guide.pdf provides a complete mapping of every paper table and figure to:

• The folder and script that reproduces it
• The data file it reads from
• The exact values reported in the paper
• A code snippet showing the key computation

---

Requirements

python >= 3.9
pandas
numpy
scipy
tensorflow >= 2.10

Install with:

pip install pandas numpy scipy tensorflow

---

Citation

If you use this code or data, please cite the paper:

[Citation to be added upon publication]