aiqbench analysis
TraceCodec introduces a compiler-backed neural architecture that resolves the bottleneck of decoding latent representations into deterministic, protocol-compliant PCAP traces. By explicitly managing TCP state and flow slots within a continuous latent space, it achieves near-perfect fidelity in generating complex network traffic for security testing and validation. This work bridges machine learning synthesis with rigorous networking constraints, offering a robust alternative to post-hoc repair methods common in current packet generators.
TraceCodec: A Compiler-Backed Neural Codec for Network Traffic Traces
arXiv:2605.29941v2 Announce Type: replace-cross Abstract: Critical networking workflows require high-fidelity packet captures (PCAPs) for testing, security analysis, and protocol validation, not just statistical flow-level summaries. Recent packet generators have demonstrated protocol-constrained PCAP synthesis, but many operate on raw or near-raw packet representations. These representations can entangle learned behavioral choices with deterministic protocol rules and make packet correctness depend on post-hoc repair. We identify the decode interface as a key bottleneck and present TraceCodec, a compiler-backed neural codec for stateful multi-flow traces. TraceCodec lifts each parsed packet into a timed packet action with explicit flow slots and transport cues, learns a continuous per-packet latent, and uses a state-aware deterministic compiler to decode actions to PCAPs while managing endpoint assignment, TCP sequence and acknowledgment state, declared compatibility constraints, and packet rendering. On CICIDS2017 Monday, TraceCodec matches packet count, protocol composition, and flow population to within 0.03%; raw-field baselines produce substantially larger flow-count and TCP-event errors under the same non-repair policy. In a matched flow-matching continuation setup, TraceCodec yields complete decoded suffixes in 100% of CICIDS2017 cases and 98.44% of MAWI cases, versus at most 10.94% for raw-field latent controls. Structural diagnostics further show that TraceCodec preserves TCP transitions and multi-flow interleaving. Together, these results support TraceCodec as a generator-facing latent interface with a deterministic path back to usable packet traces.
Abstract:Critical networking workflows require high-fidelity packet captures (PCAPs) for testing, security analysis, and protocol validation, not just statistical flow-level summaries. Recent packet generators have demonstrated protocol-constrained PCAP synthesis, but many operate on raw or near-raw packet representations. These representations can entangle learned behavioral choices with deterministic protocol rules and make packet correctness depend on post-hoc repair. We identify the decode interface as a key bottleneck and present TraceCodec, a compiler-backed neural codec for stateful multi-flow traces. TraceCodec lifts each parsed packet into a timed packet action with explicit flow slots and transport cues, learns a continuous per-packet latent, and uses a state-aware deterministic compiler to decode actions to PCAPs while managing endpoint assignment, TCP sequence and acknowledgment state, declared compatibility constraints, and packet rendering. On CICIDS2017 Monday, TraceCodec matches packet count, protocol composition, and flow population to within 0.03%; raw-field baselines produce substantially larger flow-count and TCP-event errors under the same non-repair policy. In a matched flow-matching continuation setup, TraceCodec yields complete decoded suffixes in 100% of CICIDS2017 cases and 98.44% of MAWI cases, versus at most 10.94% for raw-field latent controls. Structural diagnostics further show that TraceCodec preserves TCP transitions and multi-flow interleaving. Together, these results support TraceCodec as a generator-facing latent interface with a deterministic path back to usable packet traces.
Networking and Internet Architecture (cs.NI); Machine Learning (cs.LG)
arXiv:2605.29941 [cs.NI]
(or arXiv:2605.29941v2 [cs.NI] for this version)
https://doi.org/10.48550/arXiv.2605.29941 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 310 words
