alirezaaminzadeh/tlsflow-traffic-classifier

TLSFlow Traffic Classifier — Model Card

Model Description

TLSFlow Transformer classifies encrypted network traffic into 9 categories using flow metadata only. No payload decryption or inspection is performed.

Developed by: Aria AI Security Engineering Team
Model type: Ensemble (Transformer Encoder + LightGBM baselines)
Language: English
License: MIT

Intended Use

• SOC traffic triage and encrypted flow classification
• Research on metadata-only traffic analysis
• Demonstration of deep learning on network flow sequences

Out-of-Scope Use

• Real-time inline DPI replacement
• Decrypting or inspecting TLS payloads
• Production deployment without validation on your network

Training Data

Fully synthetic flow metadata generated with class-specific packet timing and size patterns. No real PCAP data was used.

Evaluation Metrics

• Macro F1 Score
• Per-class Recall
• PR-AUC (macro)
• False Positives per 10,000 flows
• CPU/GPU inference latency

Limitations

• Trained on synthetic data — performance on real networks may vary
• Does not inspect encrypted payloads
• Class boundaries may overlap (e.g., VPN vs normal HTTPS)

Ethical Considerations

This model is designed for defensive security purposes. Do not use for unauthorized network monitoring.