arXiv：cs.LG· Priyanka Sinha, Nikolaos Kekatos, Stylianos Basagiannis, Antonio Anastasio Bruto da Costa, Alexios Lekidis, Pabitra Mitra, Tom Nianios, Elpiniki Papageorgiou·· 6 小时前AI 评分26
从配对观测点抓包中可解释挖掘 IPv6 扩展头存在模式
Explainable Rule Mining of IPv6 Extension-Header Presence Patterns from Paired-Vantage Captures
AI 导读
研究用可解释时序逻辑规则挖掘器分析 JAMES 配对观测点数据集，仅恢复出一条可移植的 Fragment-EH 规则，但负对照协议证明它只是包内近乎定义性的共现，而非跨包时序模式。
正文
Abstract:IPv6 extension headers (EHs), such as fragmentation, segment routing, and in-situ telemetry, are operationally important yetwidely dropped in transit, and characterising their behaviour from packet captures is a recurring measurement problem. We ask whetheran explainable miner can recover human-readable rules of EH behaviour, and we contribute two reusable tools: a negative-control protocol that diagnoses whether a mined "temporal" network rule reflects genuine cross-packet dynamics or mere within-packetco-occurrence, and a sender-conditioned, per-family EH-retention measurement. Applying an interpretable temporal-logic rule miner to the JAMES paired-vantage dataset, we recover a portable Fragment-EH rule that the protocol reveals to be a within-packet,near-definitional co-occurrence rather than a temporal pattern, so the temporal-logic machinery does no work for this dominant rule;the retention measurement independently recovers the expected within-window ordering of EH observability. Our main result istherefore an honest, controlled negative finding, corroborated by executed decision-tree and large-language-model baselines: on theevaluated JAMES traces network-temporal structure does not carry the dominant Fragment-EH signal, and we supply the controls thatestablish when it would, validated on a synthetic positive control containing a genuine cross-packet dependency.
| Comments: | 6 pages, 1 figure, 2 tables. Accepted at the 2026 IEEE International Conference on Cyber Security and Resilience (IEEE CSR 2026) |
| Subjects: | Cryptography and Security (cs.CR); Machine Learning (cs.LG); Networking and Internet Architecture (cs.NI) |
| Cite as: | arXiv:2610.08090 [cs.CR] |
| (or arXiv:2610.08090v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.08090 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Priyanka Sinha [view email]
[v1]
Tue, 6 Oct 2026 10:21:12 UTC (84 KB)
来源：arXiv：cs.LG · arxiv.org