Research Notes
Short, practical explanations of research from the Hajaj Lab — updated as projects develop.
New classes in seconds, without retraining
Most traffic classifiers become expensive to maintain when applications and threats change. Classification by retrieval stores compact flow representations and learns a new class by adding a few labeled examples to the index. The same nearest-neighbor distance also helps detect traffic that does not belong to any known class.
Accuracy is only one part of a deployable classifier
Real network systems also care about update time, memory, latency, privacy, and behavior on unknown traffic. Our work measures those trade-offs explicitly so a model can be chosen for the operating environment, not only for a benchmark leaderboard.
Security and clinical ML share a hard problem
Both domains change after deployment, contain rare high-cost cases, and punish confident mistakes. That makes robustness, out-of-distribution detection, interpretable evidence, and careful validation common design requirements across our cyber and health projects.