PCAP-LM: An LLM-Native Text Representation for TLS Bulk Traffic Analysis
Ranking
Overall
75
Content
90
Popularity
40
Observed public metrics from 1 member.
Merged summary
TL;DR - PCAP-LM converts verbose TLS packet captures into an LLM-oriented text format, shrinking them enough to fit entire captures in one context window while retaining strong forensic QA performance.
- Encodes packet direction, TCP/TLS state, size, and timing with a compact ASCII “PacketGlyph” alphabet.
- Combines constrained PMI-BPE tokenization, motif run-length encoding, and a lossless packet-reference side index.
- Achieved 812× compression over
tshark -Vand 99.3% QA accuracy, versus 51.0% for a token-matchedtsharkprefix. - Evaluation was limited to homogeneous 4G/5G TLS 1.3 downloads; retransmission detection had a 24% false-negative rate.
Sources (1)
PCAP-LM: An LLM-Native Text Representation for TLS Bulk Traffic Analysis
Public signals
Semantic Scholar citations 0 · Semantic Scholar influential citations 0
TL;DR - PCAP-LM converts verbose TLS packet captures into an LLM-oriented text format, shrinking them enough to fit entire captures in one context window while retaining strong forensic QA performance.
- Encodes packet direction, TCP/TLS state, size, and timing with a compact ASCII “PacketGlyph” alphabet.
- Combines constrained PMI-BPE tokenization, motif run-length encoding, and a lossless packet-reference side index.
- Achieved 812× compression over
tshark -Vand 99.3% QA accuracy, versus 51.0% for a token-matchedtsharkprefix. - Evaluation was limited to homogeneous 4G/5G TLS 1.3 downloads; retransmission detection had a 24% false-negative rate.