The generation of high-fidelity, controllable malicious network traffic is essential for simulating realistic cyberattacks, evaluating defense mechanisms, and enhancing intrusion detection systems (IDS). However, existing approaches often suffer from low protocol fidelity, limited structural control, and poor adaptability, reducing their effectiveness in practical cybersecurity applications. We introduce TrafficT5, a three-stage, self-correcting framework that turns natural-language intents into executable PCAPs. It (i) predicts flow-level features, (ii) generates byte-aligned hex under a fixed 00–FF vocabulary, and (iii) invokes a repair module that deterministically enforces protocol invariants and performs detector-guided, iterative byte-level correction trained with multi-task objectives. The result is traffic that is both semantically coherent and protocol-compliant. Extensive evaluations on five network datasets demonstrate that TrafficT5 achieves an average Bad Packet Rate (BPR) of only 0.32%, significantly outperforming existing methods. Furthermore, synthetic malicious flows generated by TrafficT5 are reliably detected as threats by mainstream IDSs, and augmenting datasets with these flows improves F1 detection scores by over 5% under low-resource conditions.

Although encryption offers strong anonymity, it also facilitates the concealment of malicious activities, allowing adversaries to evade detection, and posing a great challenge to cybersecurity surveillance. Many existing encrypted traffic classification methods struggle to integrate flow- and packet-level tasks effectively, as they are trained independently, which is redundancy. Additionally, packet header and payload are treated equally, leading to the rich information in raw bytes remains fully unexplored, particularly in the abundant payload data. Moreover, they neglect the semantic invariance and common features between data samples, which ultimately results in suboptimal performance. To address these challenges, we propose an effective Multi-Task model using Dual Embedding and Graph Contrastive Learning (MT-DEGCL). Based on the byte-packet-flow structure of network traffic, a parallel dual embedding embeds the header and payload separately, followed by a cross-gated feature fusion strategy to capture the strong local packet-level representation. Then, we construct the traffic interaction graph and further utilize graph contrastive learning to extract the robust global flow-level representation. Finally, a multi-task model is trained for joint flow- and packet-level classification, leveraging the complementary learning between tasks to enhance overall performance. The experimental results on four real datasets highlight the effectiveness of MT-DEGCL, demonstrating superior performance in both tasks. Specifically, on the ISCX-Tor dataset, MT-DEGCL achieves F1 scores of 98.63% for flow-level classification and 98.10% at the packet level, surpassing the state-of-the-art (i.e., DE-GNN) by 2.03% and 83.21%, respectively. Furthermore, MT-DEGCL maximizes the rich information in raw payload bytes, significantly reducing or even nearly eliminating classification loss when using only payload data.

Abstract Anonymous communication serves as the preferred tool for cyber attackers to evade detection, posing a serious threat to cyberspace security. Accurately tracking the attackers in anonymous communication is crucial for defending against attacks. Flow correlation is an effective method that can link flows in the anonymous network. Existing flow correlation methods usually rely on a long observation, resulting in reduced correlation precision and limited generalization ability within anonymous communication. To address this issue, we propose a robust two-stage flow correlation method called RTsFCM via Siamese network and ensemble voting scheme. In the first stage, a Siamese network with shared weights is utilized to automatically extract the multilevel features from ingress flow and egress flow, respectively. Further, they are concatenated to generate a more expressive feature set to enhance true positive rate (TPR). In the second stage, flow pairs are firstly divided into a series of partially overlapping sub-flows(windows) in view of flow duration. Then, pairwise comparison for each window is conducted independently and the ensemble voting scheme is adopted across these windows to reduce the false positive rate (FPR) significantly. Experimental results show that RTsFCM is superior to the state of the art, achieving over a 4% increase in both TPR and F1_score. Simultaneously, it obtains an FPR as low as 0.68%, utilizing the packet timing characteristics within the initial portion of a flow.

While Tor provides strong anonymity, it also facilitates the concealment of malicious activities, which poses a significant challenge to cybersecurity surveillance. As an effective anti-anonymity technique, Website Fingerprinting(WF) enables the inference of which websites a user is visiting, thereby uncovering potential attacker activities. State-of-the-art(SOTA) methods have demonstrated remarkable effectiveness. However, a large number of labeled traffic is required to ensure effectiveness, and without timely updates, these models will encounter serious challenges of concept drift due to the dynamic nature of website content and network conditions. The core reasons lie in the independently and identically distributed assumption, while in challenging open-world scenarios, the long-term spatial and temporal dynamics complicates data consistency and effective knowledge transfer. To address these issues, this paper presents WF-TFC, an open-world few-shot anonymous WF model via self-supervised contrastive learning and time-frequency consistency. It aligns time- and frequency-based representations in the latent time-frequency space, enhancing the sustained effectiveness of inherent patterns across various websites. Consequently, it accommodates diverse few-shot target domains with varying dynamics, facilitating data consistency and knowledge transfer in unobserved long-term temporal and spatial environments. For instance, with only 5 traces per website, WF-TFC achieves 92.62% accuracy on traces collected six weeks after pre-training, exceeding the SOTA(i.e., NetCLR) by 2.12%. On similar but mutually exclusive traces, it attains an F1 score of 87.20%, surpassing the SOTA by 6.12%.

Most information retrieval systems on the Internet rely primarily on similarity ranking algorithms based solely on term frequency statistics. Information quality is usually ignored. This leads to the problem that documents are retrieved without regard to their quality. We present an approach that combines similarity-based similarity ranking with quality ranking in centralized and distributed search environments. Six quality metrics, including the currency, availability, information-to-noise ratio, authority, popularity, and cohesiveness, were investigated. Search effectiveness was significantly improved when the currency, availability, information-to-noise ratio and page cohesiveness metrics were incorporated in centralized search. The improvement seen when the availability, information-to- noise ratio, popularity, and cohesiveness metrics were incorporated in site selection was also significant. Finally, incorporating the popularity metric in information fusion resulted in a significant improvement. In summary, the results show that incorporating quality metrics can generally improve search effectiveness in both centralized and distributed search environments.

Centralized search process requires that the whole collection reside at a single site. This imposes a burden on both the system storage of the site and the network traffic near the site. It thus comes to require the search process to be distributed. Recently, more and more Web sites provide the ability to search their local collection of Web pages. Query brokering systems are used to direct queries to the promising sites and merge the results from these sites. Creation of meta-information of the sites plays an important role in such systems. In this article, we introduce an ontology-based web site mapping method used to produce conceptual meta-information, the Vector Space approach, and present a serial of experiments comparing it with Naïve-Bayes approach. We found that the Vector Space approach produces better accuracy in ontology-based web site mapping.