Search papers, labs, and topics across Lattice.
The paper introduces TraceCodec, a state-aware neural codec that learns a continuous latent representation of network traffic traces by lifting packets into timed packet actions with explicit flow slots and transport cues. A deterministic compiler then lowers these decoded actions back into PCAPs, handling endpoint assignment, TCP state, and legality constraints. TraceCodec achieves high-fidelity packet trace generation, matching packet count, protocol composition, and flow population within 0.03% on the CICIDS2017 Monday dataset, significantly outperforming raw-field baselines.
By disentangling learned behavioral choices from deterministic protocol consequences, TraceCodec unlocks high-fidelity network traffic generation that preserves TCP state transitions and multi-flow interleaving, unlike existing raw-field decoders.
Critical networking workflows require high-fidelity packet captures (PCAPs) for testing, security analysis, and protocol validation, not just statistical flow-level summaries. Recent packet generators have demonstrated protocol-constrained PCAP synthesis, but they universally decode directly to raw packet fields. That interface entangles learned behavioral choices with deterministic protocol consequences, which forces packet realization to depend on post-hoc heuristic repair. We identify this decode interface as the fundamental bottleneck and present TraceCodec, a state-aware neural codec for stateful multi-flow traces. TraceCodec lifts each packet into a timed packet action with explicit flow slots and transport cues, then learns a continuous per-packet latent. A deterministic compiler lowers decoded actions back to PCAPs, owning endpoint assignment, TCP state, legality constraints, and packet rendering. The latent layer exposes a generator-facing sequence space, so downstream traffic models can operate on packet-action latents rather than raw header fields. On CICIDS2017 Monday, TraceCodec matches packet count, protocol composition, and flow population to within 0.03%. Raw-field baselines under the same non-repair policy distort flow counts and TCP state by orders of magnitude. Structural diagnostics show that TraceCodec preserves TCP state transitions and multi-flow interleaving that raw-field decoders fragment. This work establishes a new foundation for high-fidelity packet-trace generation.
Tsinghua AI