The Colossus with Feet of Clay: Debunking Encrypted Traffic Classifiers under PQC Evolution

• URL: http://arxiv.org/abs/2608.22683v1
• Date: Mon, 24 Aug 2026 00:51:11 GMT
• Title: The Colossus with Feet of Clay: Debunking Encrypted Traffic Classifiers under PQC Evolution
• Abstract summary: TLS migration toward post-quantum cryptography (PQC) challenges assumption because hybrid key establishment can reshape observable traffic without changing application labels.<n>We frame this change as PQC-induced protocol drift and study its effects through closed-world HTTPS website fingerprinting.<n>We offer strategic guidance, identify cross-domain fragility as a research priority, and recommend protocol-aware practices for dependable real-world encrypted traffic classification.
• Score: 6.277767508192155
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Encrypted traffic classifiers often achieve high accuracy under matched training and testing conditions, implicitly assuming that deployment traffic follows the training distribution. TLS migration toward post-quantum cryptography (PQC) challenges this assumption because hybrid key establishment can reshape observable traffic without changing application labels. We frame this change as PQC-induced protocol drift and study its effects through closed-world HTTPS website fingerprinting using the deployed TLS~1.3 Hybrid-PQC group \texttt{\detokenize{X25519MLKEM768}}. We build a controlled, PQC-aware benchmark pairing Traditional (Non-PQC) and Hybrid-PQC traffic, then evaluate five representative classifiers and side-channel representations under matched-domain, cross-domain, and deployment-ratio settings. Collectively, the experiments show that PQC evolution does not remove learnable website information. Instead, it changes how that information appears in traffic, causing classifiers and feature combinations that perform well in-domain to lose reliability across cryptographic domains. By exposing the fragility of matched-domain evaluation, we offer strategic guidance, identify cross-domain robustness as a research priority, and recommend protocol-aware practices for dependable real-world encrypted traffic classification. The code is available at http://anonymous.4open.science/r/PQ-WF-Eval.

Related papers

• CipherSight: Robust Website Fingerprinting via Record-Resource Semantic Supervision under Distribution Shifts [5.86043296080285]
  HTTPS website fingerprinting aims to identify visited websites from metadata observable in encrypted traffic.<n>Existing methods primarily learn from raw TCP packet sequences.<n>We propose CipherSight, a TLS-record-based hierarchical framework for robust HTTPS WF.
  arXiv  Detail & Related papers  (2026-08-14T03:17:57Z)
• Physics-Informed Structure Anchoring With Capture-Aware Prototype Calibration for Cross-Environment RF Fingerprinting [9.281236432794417]
  Radio frequency fingerprint identification (RFFI) exploits transmitter-specific hardware imperfections for Internet of Things (IoT) devices.<n>This article proposes physicsinformed structure anchoring with capture-aware prototype calibration (PISA-CAPC) to address both representation and decision mismatches.
  arXiv  Detail & Related papers  (2026-07-06T13:23:50Z)
• Robust and Precise Application Fingerprinting on 5G Physical Uplink Channel [14.703722937793641]
  Air fingerprinting infers application activity by sniffing metadata from cellular control channels.<n>5G encrypts these channels, breaking the attack chain that prior attacks depend on.<n>This paper reveals a physical-layer side channel that bypasses encryption.
  arXiv  Detail & Related papers  (2026-06-13T09:36:34Z)
• Dance Across Shifts: Forward-Facilitation Continual Test-Time Adaptation through Dynamic Style Bridging [65.11234199720428]
  Continual Test-Time Adaptation aims to empower perception systems to handle dynamic distribution shifts encountered after deployment.<n>We introduce a novel forward-facilitation paradigm through a method termed Dynamic Style Bridging.<n>During test time, to mitigate inherent generative bias and adapt these proxies to incoming data, we propose a multi-level bridging mechanism.
  arXiv  Detail & Related papers  (2026-05-18T16:18:17Z)
• PACC: Protocol-Aware Cross-Layer Compression for Compact Network Traffic Representation [10.787806670196938]
  PACC is a redundancy-aware, layer-aware representation framework.<n>It consistently outperforms feature-engineered and raw-bit baselines.<n>It improves end-to-end efficiency by up to 3.16x.
  arXiv  Detail & Related papers  (2026-02-09T07:09:31Z)
• Connecting Domains and Contrasting Samples: A Ladder for Domain Generalization [52.52838658375592]
  We propose a new paradigm, domain-connecting contrastive learning (DCCL) to enhance conceptual connectivity across domains.<n>On the data side, more aggressive data augmentation and cross-domain positive samples are introduced to improve intra-class connectivity.<n>The results verify that DCCL outperforms state-of-the-art baselines even without domain supervision.
  arXiv  Detail & Related papers  (2025-10-19T04:13:29Z)
• Language of Network: A Generative Pre-trained Model for Encrypted Traffic Comprehension [16.795038178588324]
  Deep learning is currently the predominant approach for encrypted traffic classification through feature analysis.<n>We present GBC, a generative model based on pre-training for encrypted traffic comprehension.<n>It achieves superior results in both traffic classification and generation tasks, resulting in a 5% improvement in F1 score compared to state-of-the-art methods for classification tasks.
  arXiv  Detail & Related papers  (2025-05-26T04:04:29Z)
• MIETT: Multi-Instance Encrypted Traffic Transformer for Encrypted Traffic Classification [59.96233305733875]
  Classifying traffic is essential for detecting security threats and optimizing network management.<n>We propose a Multi-Instance Encrypted Traffic Transformer (MIETT) to capture both token-level and packet-level relationships.<n>MIETT achieves results across five datasets, demonstrating its effectiveness in classifying encrypted traffic and understanding complex network behaviors.
  arXiv  Detail & Related papers  (2024-12-19T12:52:53Z)
• Real-Time Motion Prediction via Heterogeneous Polyline Transformer with Relative Pose Encoding [121.08841110022607]
  Existing agent-centric methods have demonstrated outstanding performance on public benchmarks. We introduce the K-nearest neighbor attention with relative pose encoding (KNARPE), a novel attention mechanism allowing the pairwise-relative representation to be used by Transformers. By sharing contexts among agents and reusing the unchanged contexts, our approach is as efficient as scene-centric methods, while performing on par with state-of-the-art agent-centric methods.
  arXiv  Detail & Related papers  (2023-10-19T17:59:01Z)
• MD-CSDNetwork: Multi-Domain Cross Stitched Network for Deepfake Detection [80.83725644958633]
  Current deepfake generation methods leave discriminative artifacts in the frequency spectrum of fake images and videos. We present a novel approach, termed as MD-CSDNetwork, for combining the features in the spatial and frequency domains to mine a shared discriminative representation.
  arXiv  Detail & Related papers  (2021-09-15T14:11:53Z)
• Exploring Sequence Feature Alignment for Domain Adaptive Detection Transformers [141.70707071815653]
  We propose a novel Sequence Feature Alignment (SFA) method that is specially designed for the adaptation of detection transformers. SFA consists of a domain query-based feature alignment (DQFA) module and a token-wise feature alignment (TDA) module. Experiments on three challenging benchmarks show that SFA outperforms state-of-the-art domain adaptive object detection methods.
  arXiv  Detail & Related papers  (2021-07-27T07:17:12Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.