Packet and Flow Evaluation Boundaries in Network Traffic Learning

Abstract

Evaluation partitions define what a network-traffic model is asked to generalize across. We generate two hundred flows with twelve packets each, a class-related signal, and a near-constant latent fingerprint shared within each flow. Across twenty independent worlds, a nearest-packet classifier obtains 99.92% mean accuracy under random packet splitting but 70.74% when entire flows are held out. A logistic model using only the class-related coordinate changes from 93.20% to 92.82%. Training and test packet counts remain 1,560 and 840 under both protocols. Original split mosaics, nearest-neighbor routes, paired accuracy changes, and a prevalence-to-precision calculation identify why a seemingly superior method can lose its advantage under a different evaluation unit. The data are generated latent features, not captured packets or a real attack benchmark. The study provides an audit of within-flow recognition versus unseen-flow prediction and distinguishes that issue from temporal or cross-network deployment validation.