Explainers

Encrypted traffic,

Saying "I don't know" has a price

Turn the dial from rejecting 10% to 30% of traffic

Unknown traffic caught true detection rate up to +50%
Known traffic wrongly rejected false detection rate under +10%
A classifier that may refuse a little more traffic catches far more apps it has never seen, at a small cost in false alarms. The best detection technique also changes with the threshold. From our FedCSIS 2025 paper.

Classic deep packet inspection had a safe fallback: whatever it did not recognise, it called “other”. An AI classifier has no such habit. Shown traffic from an app it never trained on, it confidently picks one of the classes it knows. With encrypted DNS and encrypted server names spreading, AI classifiers are replacing inspection engines, so this matters.

Out-of-distribution (OOD) detection lets the model say “I don’t know”. The catch is the threshold: how much traffic it should be willing to reject. Reject too little and unknown apps slip through as known ones; reject too much and good traffic is turned away. We compared state-of-the-art OOD techniques for traffic classification across rejection rates, and found that the best technique changes with the threshold.

The practical result: raising the rejection rate from 10% to 30% improved the true detection rate of unknown traffic by up to 50%, while the false detection rate rose by less than 10%. Our advice is to report OOD results across rejection rates, not at a single convenient point, and to choose the operating point that fits the network.