@article{koumar2025cesnet,
  title={CESNET-TimeSeries24: Time Series Dataset for Network Traffic Anomaly Detection and Forecasting},
  author={Koumar, Josef and Hynek, Karel and Čejka, Tomáš and Šiška, Pavel},
  journal={Scientific Data},
  volume={12},
  number={1},
  pages={338},
  year={2025},
  publisher={Nature Publishing Group UK London},
  url={https://www.nature.com/articles/s41597-025-04603-x},
  abstract={Anomaly detection in network traffic is crucial for maintaining the security of computer networks and identifying malicious activities. Most approaches to anomaly detection use methods based on forecasting. Extensive real-world network datasets for forecasting and anomaly detection techniques are missing, potentially causing overestimation of anomaly detection algorithm performance and fabricating the illusion of progress. This manuscript tackles this issue by introducing a comprehensive dataset derived from 40 weeks of traffic transmitted by 275,000 active IP addresses in the CESNET3 network—an ISP network serving approximately half a million customers daily. It captures the behavior of diverse network entities, reflecting the variability typical of an ISP environment. This variability provides a realistic and challenging environment for developing forecasting and anomaly detection models, enabling evaluations that are closer to real-world deployment scenarios. It provides valuable insights into the practical deployment of forecast-based anomaly detection approaches.},
}

@article{koumar2024nettisa,
  title={Nettisa: Extended ip flow with time-series features for universal bandwidth-constrained high-speed network traffic classification},
  author={Koumar, Josef and Hynek, Karel and Pešek, Jaroslav and Čejka, Tomáš},
  journal={Computer Networks},
  volume={240},
  pages={110147},
  year={2024},
  publisher={Elsevier},
  url={https://www.sciencedirect.com/science/article/pii/S1389128623005923},
  abstract={Network traffic monitoring based on IP Flows is a standard monitoring approach that can be deployed to various network infrastructures, even the large ISP networks connecting millions of people. Since flow records traditionally contain only limited information (addresses, transport ports, and amount of exchanged data), they are also commonly extended by additional features that enable network traffic analysis with high accuracy. These flow extensions are, however, often too large or hard to compute, which then allows only offline analysis or limits their deployment only to smaller-sized networks. This paper proposes a novel extended IP flow called NetTiSA (Network Time Series Analysed) flow, based on analysing the time series of packet sizes. By thoroughly testing 25 different network traffic classification tasks, we show the broad applicability and high usability of NetTiSA flow. For practical deployment, we also consider the sizes of flows extended by NetTiSA features and evaluate the performance impacts of their computation in the flow exporter. The novel features proved to be computationally inexpensive and showed excellent discriminatory performance. The trained machine learning classifiers with proposed features mostly outperformed the state-of-the-art methods. NetTiSA finally bridges the gap and brings universal, small-sized, and computationally inexpensive features for traffic classification that can be scaled up to extensive monitoring infrastructures, bringing the machine learning traffic classification even to 100 Gbps backbone lines.},
}

@inproceedings{koumar2023network,
  title={Network traffic classification based on single flow time series analysis},
  author={Koumar, Josef and Hynek, Karel and Čejka, Tomáš},
  booktitle={2023 19th International Conference on Network and Service Management (CNSM)},
  pages={1--7},
  year={2023},
  organization={IEEE},
  url={https://ieeexplore.ieee.org/abstract/document/10327876},
  abstract={Network traffic monitoring using IP flows is used to handle the current challenge of analyzing encrypted network communication. Nevertheless, the packet aggregation into flow records naturally causes information loss; therefore, this paper proposes a novel flow extension for traffic features based on the time series analysis of the Single Flow Time series, i.e., a time series created by the number of bytes in each packet and its timestamp. We propose 69 universal features based on the statistical analysis of data points, time domain analysis, packet distribution within the flow timespan, time series behavior, and frequency domain analysis. We have demonstrated the usability and universality of the proposed feature vector for various network traffic classification tasks using 15 well-known publicly available datasets. Our evaluation shows that the novel feature vector achieves classification performance similar or better than related works on both binary and multiclass classification tasks. In more than half of the evaluated tasks, the classification performance increased by up to 5 %.}
}

@inproceedings{koumar2022network,
  title={Network traffic classification based on periodic behavior detection},
  author={Koumar, Josef and Čejka, Tomáš},
  booktitle={2022 18th International Conference on Network and Service Management (CNSM)},
  pages={359--363},
  year={2022},
  organization={IEEE},
  url={https://ieeexplore.ieee.org/abstract/document/9964556},
  abstract={Even though encryption hides the content of communication from network monitoring and security systems, this paper shows a feasible way to retrieve useful information about the observed traffic. The paper deals with detection of periodic behavioral patterns of the communication that can be detected using time series created from network traffic by autocorrelation function and Lomb-Scargle periodogram. The revealed characteristics of the periodic behavior can be further exploited to recognize particular applications. We have experimented with the created dataset of 61 classes, and trained a machine learning classifier based on XGBoost that performed the best in our experiments, reaching 90% F1-score.},
}

@inproceedings{koumar2023unevenly,
  title={Unevenly spaced time series from network traffic},
  author={Koumar, Josef and {\v{C}}ejka, Tomas},
  booktitle={2023 7th Network Traffic Measurement and Analysis Conference (TMA)},
  pages={1--4},
  year={2023},
  organization={IEEE},
  url={https://ieeexplore.ieee.org/abstract/document/10198988},
  abstract={Reliable detection of security events is essential for network security. Therefore, a suitable traffic representation and model are required. Contrary to the currently used approaches, this paper presents Unevenly Spaced Time Series (USTS) as a feasible representation of network traffic with several brilliant benefits for analysis. The article concerns several types of USTS. A dataset captured on a real ISP network was created to evaluate the properties of USTS. The dataset contains over 35 million time series. We experimentaly proved the USTS is suitable for network traffic analysis and allow automatic processing, e.g., to classify network traffic.},
}

@inproceedings{janvcivcka2024analysis,
  title={Analysis of statistical distribution changes of input features in network traffic classification domain},
  author={Jančička, Lukáš and Koumar, Josef and Soukup, Dominik and Čejka, Tomáš},
  booktitle={NOMS 2024-2024 IEEE Network Operations and Management Symposium},
  pages={1--4},
  year={2024},
  organization={IEEE},
  url={https://ieeexplore.ieee.org/abstract/document/10575630},
  abstract={This study investigates the evolving landscape of network traffic monitoring, which is crucial for maintaining computer network services and security. Traditional methods like Deep Packet Inspection (DPI) face challenges due to increased privacy protection through encryption, prompting a shift towards statistical-based detection using Machine Learning (ML). On the other hand, ML struggles with long-term evaluation due to various distribution changes. This study focuses on the CESNET-TLS-Year22 dataset, derived from one year of TLS network traffic on the CESNET2 backbone. Described research explores the behavior of modern protocols in real-world scenarios and their impact on dataset quality. The main result of our analysis is the identification of the Weekend phenomenon in network traffic classification that is generally overlooked during ML model training.},
}

@inproceedings{pesek2023augmenting,
  title={Augmenting monitoring infrastructure for dynamic software-defined networks},
  author={Pesek, Jaroslav and Plny, Richard and Koumar, Josef and Jerabek, Kamil and Čejka, Tomáš},
  booktitle={2023 8th International Conference on Smart and Sustainable Technologies (SpliTech)},
  pages={1--4},
  year={2023},
  organization={IEEE},
  url={https://ieeexplore.ieee.org/abstract/document/10193216},
  abstract={Software-Defined Networking (SDN) and virtual environment raise new challenges for network monitoring tools. The dynamic and flexible nature of these network technologies requires adaptation of monitoring infrastructure to overcome challenges of analysis and interpretability of the monitored network traffic. This paper describes a concept of automatic on-demand deployment of monitoring probes and correlation of network data with infrastructure state and configuration in time. Such an approach to monitoring SDN & virtual networks is usable in several use cases, such as IoT networks and anomaly detection. It increases visibility into complex and dynamic networks. Additionally, it can help with the creation of well-annotated datasets that are essential for any further research.},
}

@inproceedings{koumar2025towards,
  title={Towards building network outlier detection system for network traffic monitoring},
  author={Koumar, Josef and Pešek, Jaroslav and Jerabek, Kamil and Čejka, Tomáš},
  booktitle={NOMS 2025-2025 IEEE Network Operations and Management Symposium},
  pages={1--6},
  year={2025},
  organization={IEEE},
  url={https://ieeexplore.ieee.org/abstract/document/11073727},
  abstract={Traffic monitoring is important for supporting network security and management. Recent advancements have explored machine learning-based approaches to classify encrypted traffic, yet the challenge of obtaining current threat datasets persists, leaving supervised models reliant on outdated information. Outlier detection, which identifies anomalous network behavior without requiring labeled data, addresses this limitation by flagging suspicious deviations from expected patterns. This paper proposes a novel Network Outlier Detection System (NODS), a platform based on open-source software designed to detect outliers in network traffic by leveraging forecasting models. Our system was deployed and tested on a large ISP infrastructure. The evaluation of detected outliers over a one-month period showed key insights into system performance and provided valuable lessons for future deployment of outlier detection methods. This paper details the architecture of NODS, deployment, and performance while highlighting the challenges and lessons learned in building an effective outlier detection system for network traffic.},
}

@inproceedings{jerabek2025explainable,
  title={Explainable Anomaly Detection in Network Traffic Using LLM},
  author={Jerabek, Kamil and Koumar, Josef and Setinský, Jiří and Pešek, Jaroslav},
  booktitle={NOMS 2025-2025 IEEE Network Operations and Management Symposium},
  pages={1--6},
  year={2025},
  organization={IEEE},
  url={https://ieeexplore.ieee.org/abstract/document/11073574},
  abstract={Network anomaly detection is essential for modern cybersecurity, yet existing systems often generate numerous alerts without clear explanations, leading to inefficiencies and high false-positive rates. This paper proposes a novel approach that integrates Large Language Models (LLMs) with an anomaly detection framework to enhance explainability in network traffic analysis. Instead of directly detecting anomalies, the LLM only interprets already flagged anomaly events, providing insights into their potential root causes. Our method reduces LLM over-usage while improving decision-making for security analysts. We evaluated our approach using real-world network traffic data, demonstrating its ability to enhance situational awareness, reduce false positives, and support more effective cybersecurity practices.},
}

@ARTICLE{11268324,
  author={Koumar, Josef and Smoleň, Timotej and Jeřábek, Kamil and Čejka, Tomáš},
  journal={IEEE Transactions on Network and Service Management}, 
  title={Comparative Analysis of Deep Learning Models for Real-World ISP Network Traffic Forecasting}, 
  year={2026},
  volume={23},
  number={},
  pages={715-728},
  doi={10.1109/TNSM.2025.3636557},
  url={https://ieeexplore.ieee.org/document/11268324},
  abstract={Accurate network traffic forecasting is crucial for Internet service providers to optimize resources, improve user experience, and detect anomalies. Until recently, the lack of large-scale, real-world datasets limited the fair evaluation of forecasting methods. The newly released CESNET-TimeSeries24 dataset addresses this gap by providing multivariate traffic data from thousands of devices over 40 weeks at multiple aggregation granularities and hierarchy levels. In this study, we leverage the CESNET-TimeSeries24 dataset to conduct a systematic evaluation of state-of-the-art deep learning models and provide practical insights. Moreover, our analysis reveals trade-offs between prediction accuracy and computational efficiency across different levels of granularity. Beyond model comparison, we establish a transparent and reproducible benchmarking framework, releasing source code and experiments to encourage standardized evaluation and accelerate progress in network traffic forecasting research.},
}

@inproceedings{janvcivcka2024mfwdd,
  title={MFWDD: Model-based Feature Weight Drift Detection Showcased on TLS and QUIC Traffic},
  author={Jančička, Lukáš and Soukup, Dominik and Koumar, Josef and Němec, Filip and Čejka, Tomáš},
  booktitle={2024 20th International Conference on Network and Service Management (CNSM)},
  pages={1--5},
  year={2024},
  organization={IEEE},
  url={https://ieeexplore.ieee.org/abstract/document/10814630},
  abstract={Machine learning (ML) represents an efficient and popular approach for network traffic classification. However, network traffic inspection is a challenging domain and trained models may degrade soon after deployment. Besides biases present during data captures and model creation, data drifts contribute significantly to ML model degradation. This paper proposes a novel method called Model-based Feature Weight Drift Detection (MFWDD) for concept drift detection. It is a part of a public software framework suited for dataset drift analysis tailored to the domain of network traffic. This work addresses TLS and QUIC service classification problems, examines a variety of experiments analyzing the evolution of the respective distributions, and observes their degradation over time on different ML features. The MFWDD framework guided TLS and QUIC services classification models retraining throughout an extensive period and not only prevented model degradation but also improved its performance and consistency over time.},
}

@inproceedings{koumar2023enhancing,
  title={Enhancing DeCrypto: Finding Cryptocurrency Miners Based on Periodic Behavior},
  author={Koumar, Josef and Plný, Richard and Čejka, Tomáš},
  booktitle={2023 19th International Conference on Network and Service Management (CNSM)},
  pages={1--7},
  year={2023},
  organization={IEEE},
  url={https://ieeexplore.ieee.org/abstract/document/10327904},
  abstract={While the popularity of cryptocurrencies and the whole industry's value are rising, the number of threat actors who use illegal “coin miner mal ware” is increasing as well. The threat actors commonly use computational resources of companies, research and educational institutions, or end users. In this paper, we analyzed the long-term periodic behavior of the cryptocurrency miners communicating in computer networks. We propose a novel method for cryptominers detection using specially designed periodicity features. The detection algorithm is based on the mathematical detection of periodic Flow time series (FTS) and feature mining. Altogether with the Machine Learning technique, the resulting system achieves high-precision performance. Furthermore, our approach enhances a flow-based cryptominers detection system DeCrypto to further improve its reliability and feasibility for high-speed networks.},
}

@INPROCEEDINGS{11297445,
  author={Hulák, Matej and Bartoš, Václav and Koumar, Josef and Čejka, Tomáš},
  booktitle={2025 21st International Conference on Network and Service Management (CNSM)}, 
  title={DAF: Device Annotation Framework}, 
  year={2025},
  volume={},
  number={},
  pages={1-6},
  abstract={Accurate identification of device type and operating system in network traffic is crucial for effective network monitoring, security enforcement, and anomaly detection. Nevertheless, creating datasets for this task is limited due to problematic annotation in a real-world environment. We propose Device Annotation Framework (DAF), a modular and extensible open-source framework for annotating large-scale network datasets with operating system and device type labels. To improve annotation precision in complex environments, DAF combines multiple independent annotation sources by label fusion and conflict resolution. We evaluate DAF on a ground truth dataset collected from a mid-sized network and demonstrate its capability to produce high-quality annotations.},
  keywords={Annotations;Publishing;Operating systems;Telecommunication traffic;Fingerprint recognition;Security;Reliability;Object recognition;Monitoring;Research and development;annotation;datasets;os fingerprinting;device type fingerprinting;network traffic classification;network traffic monitoring;machine learning},
  doi={10.23919/CNSM67658.2025.11297445},
  ISSN={2165-963X},
  month={Oct},
  url={https://ieeexplore.ieee.org/document/11297445},
}

@INPROCEEDINGS{11297465,
  author={Oškera, Dominik and Koumar, Josef and Pokorná, Alžběta and Jeřábek, Kamil and Čejka, Tomáš},
  booktitle={2025 21st International Conference on Network and Service Management (CNSM)}, 
  title={Botnet Detection Through Periodic Patterns in Command-and-Control Network Traffic}, 
  year={2025},
  volume={},
  number={},
  pages={1-6},
  abstract={Detecting botnet Command-and-Control (C&C) communication in encrypted network traffic is a persistent challenge in cybersecurity, particularly in environments without endpoint visibility. We present a novel approach for botnet detection based on the inherent periodic communication patterns of C&C channels. Leveraging the Lomb-Scargle periodogram, we identify periodic behaviour in multiflow time series and extract periodic-based features for classification using machine learning. To address limitations in existing datasets, we introduce CESNET-CC25, a comprehensive and publicly available dataset comprising real-world botnet C&C traffic and benign traffic collected from an ISP backbone and controlled laboratory settings. Our method achieves high precision across both the widely used CTU-13 dataset and CESNET-CC25, with significant improvements in recall on long-duration captures. The results demonstrate that periodicity is a reliable indicator of C&C behaviour, even in modern, encrypted network environments, and that CESNET-CC25 provides a realistic benchmark for future botnet detection research.},
  keywords={Botnet;Time series analysis;Telecommunication traffic;Machine learning;Inspection;Benchmark testing;Feature extraction;Robustness;Cryptography;Computer security;botnet;Lomb-Scargle periodogram;network traffic analysis;periodic network traffic;multiflow classification;network traffic classification},
  doi={10.23919/CNSM67658.2025.11297465},
  ISSN={2165-963X},
  month={Oct},
  url={https://ieeexplore.ieee.org/document/11297465},
}

@INPROCEEDINGS{11297513,
  author={Kureš, Milan and Koumar, Josef and Hynek, Karel},
  booktitle={2025 21st International Conference on Network and Service Management (CNSM)}, 
  title={CESNET TS-Zoo: A Library for Reproducible Analysis of Network Traffic Time Series}, 
  year={2025},
  volume={},
  number={},
  pages={1-5},
  abstract={Time Series Analysis (TSA) is an essential tool in computer networking, supporting tasks such as traffic forecasting, capacity planning, load balancing, quality of service monitoring, behavior profiling, and anomaly detection. Despite its widespread use, the community was limited by the lack of sufficient datasets. Our recent dataset, CESNET-TimeSeries24, finally fills this gap. However, its substantial size presents significant challenges for practical use in research. Therefore, inspired by the other machine learning communities that often develop supportive tools and benchmarks to accelerate research, we introduced a CESNET TS-Zoo library. It is designed to streamline dataset management, experiment setting, and reproducibility in the TSA of network traffic. TS-Zoo provides a standardized API for accessing the CESNET-TimeSeries24 dataset and includes methods for time series preprocessing, multiple dataset partitioning, and data loading for experiments. Furthermore, the preprocessing steps can be exported and imported, enabling reproducible experiments. Therefore, the TS-Zoo library simplifies TSA experiments and enables reproducibility of TSA research applied in computer networking.},
  keywords={Time series analysis;Loading;Telecommunication traffic;Machine learning;Quality of service;Benchmark testing;Libraries;Reproducibility of results;Anomaly detection;Monitoring;Network traffic;Time Series;Time Series Analysis;Machine learning;Open datasets;Open-world evaluation;Library;Toolset;Reproducible evaluation},
  doi={10.23919/CNSM67658.2025.11297513},
  ISSN={2165-963X},
  month={Oct},
  url={https://ieeexplore.ieee.org/document/11297513},
}

@inproceedings{koumar2026threat,
  title={Threat Detection in Network Traffic using Time Series Analysis},
  author={Koumar, Josef and Čejka, Tomáš},
  booktitle={NOMS 2026-2026 IEEE Network Operations and Management Symposium},
  year={2026},
  organization={IEEE},
}

@inproceedings{mudrunka2026device,
  title={Device Type Classification on ISP Network using Time Series Analysis},
  author={Mudruňka, Karel and Koumar, Josef and Jeřábek, Kamil},
  booktitle={NOMS 2026-2026 IEEE Network Operations and Management Symposium},
  year={2026},
  organization={IEEE},
}

@phdthesis{koumar2026thesis,
  title={Threat Detection in Network Traffic using Time Series Analysis},
  author={Koumar, Josef},
  school={Faculty of Information Technology, Czech Technical University in Prague},
  year={2026},
  type={Doctoral dissertation},
}