Paul Schmitt

Privacy-focused proxy systems (e.g., multi-party relays, VPNs, etc.) are now standard Internet infrastructure, yet little is known about potential disparities in the privacy they provide across different populations. In this work, we investigate disparities in proxy crowd sizes, measuring how mappings between users and infrastructure can produce unequal geolocation anonymity across communities. We combine infrastructure deployment data with demographic information and apply our framework to Apple's iCloud Private Relay, analyzing 83,609 U.S. census tracts, and find significant disparities: rural users receive crowd sizes over 9× smaller than urban users, and income moderately correlates with privacy outcomes in rural areas (r=0.39) while showing negligible correlation in cities. We then explore, through simulation, strategies for improving privacy equity, demonstrating that operators can enhance privacy for the worst-protected populations by up to 2.5× using simple consolidation strategies while introducing manageable potential geolocation error.

Machine learning for network traffic analysis depends on labeled data, but the workflows used to construct training pipelines and evaluation datasets are often hard to reproduce. Labels are commonly stored outside the packet trace and attached later through dataset-specific reconstruction, thus the same raw traffic can yield different labeled datasets. We present pcapML, a system for constructing reproducible labeled network traffic datasets in PcapNG. pcapML stores label metadata inline with the packet trace so that the trace itself becomes the full dataset, rather than a packet file plus a separate reconstruction procedure. For new traffic, pcapML can assign labels during capture using eBPF-based process attribution in the Linux kernel. For existing datasets, it can ingest an explicit external label mapping and convert that mapping into the same packet-labeled format. We compare pcapML against conventional post-hoc labeling workflows and show that the differences are measurable even in controlled collection settings. The result is a common labeled trace format that makes dataset construction more reproducible and lets different studies build from an identical foundation.

Latency anomalies—persistent or transient increases in round-trip time (RTT)—are a common feature of residential Internet performance. When multiple users simultaneously experience anomalies at the same destination, it may indicate shared infrastructure issues, routing behavior, or congestion. However, inferring such shared behavior is challenging in practice. This is because the magnitude of these anomalies can vary significantly across devices, even within the same ISP and geographic area, and detailed network topology information is often unavailable due to platform limitations or privacy constraints. In this work, we study whether devices that experience a shared latency anomaly observe similar changes in RTT magnitude using a topology-agnostic approach. Using a four-month dataset of high-frequency RTT measurements from 99 residential probes in Chicago, we detect shared anomalies and analyze their consistency in amplitude and duration without relying on traceroutes or explicit path information. Building on prior change-point detection techniques, we find that many shared anomalies affect users similarly in amplitude, particularly within the same ISP. Leveraging this insight, we develop a sampling algorithm that reduces redundancy in detected anomalies by selecting representative devices under user-defined constraints. Our approach covers 95% of aggregate anomaly impact with less than half the total probes used in our deployment. Compared to two baselines, we show that our approach selects a significantly higher number of unique anomalies at similar coverage levels. Additionally, our analysis suggests that geographic diversity can play an important role in selecting probes for a single ISP even within a single city. These findings highlight the potential of using anomaly amplitude and duration as topology-independent signals for scalable monitoring, troubleshooting, and cost-effective sampling designs in residential Internet performance measurement.

Access to raw network traffic data is essential for many computer networking tasks, from traffic modeling to performance evaluation. Unfortunately, this data is scarce due to high collection costs and governance rules. and lack robust evaluations tied to real-world utility. We propose a new method based on state space models called NetSSM that generates raw network traffic at the packet-level granularity. Our approach captures interactions between multiple, interleaved flows -- an objective unexplored in prior work -- and effectively reasons about flow-state in sessions to capture traffic characteristics. NetSSM accomplishes this by training with a context window more than 8× longer, and produces traces up to 78× longer than existing transformer-based raw packet generators. compliance with standard protocol requirements and flow and session-level traffic characteristics.

Accurate and efficient inference on network traffic through machine learning models is important for many management tasks, from traffic prioritization to anomaly detection. Existing ML inference pipelines differ primarily in their feature design: those based on summary flow statistics (e.g., packet sizes, inter-arrival times) are lightweight and efficient, though they may be less accurate for fine-grained classification, whereas pipelines that consume features directly from raw packet capture data can achieve higher accuracy but at significantly greater computational and resource cost. In this paper, we develop Just-in-Time Traffic Inference(JITI), a model serving system to support fast and accurate network traffic inference in raw packet-capture-based machine learning inference pipelines. Offline, JITI builds a curated pool of diverse trained models with varied feature and performance requirements. Online, JITI responds to traffic fluctuations via an adaptive scheduler that selects the model from the pool that offers the highest accuracy-to-efficiency ratio within system resource limits, thereby providing inference accuracy comparable to the more complex and resource-intensive packet-capture-based methods, with minimal efficiency compromise. Using traffic application inference as an example task, our evaluation shows that JITI improves inference performance by 18% over flow-statistics-based methods; when benchmarked against state-of-the-art packet-capture-based methods, JITI results in a worst-case drop in F1-Score of only 12.3%, while reducing the average inference decision time by ~127x.

Despite significant investments in access network infrastructure, universal access to high-quality Internet connectivity remains a challenge. Policymakers often rely on crowdsourced datasets to assess Internet performance across geographic regions. However, such datasets exhibit non-uniform sampling densities and misalignment with infrastructure boundaries. This work presents a spatial analysis framework to construct stable sampling boundaries for Internet performance metrics using crowdsourced latency data. We apply statistical techniques to aggregate performance over geographic regions, interpolate unsampled locations, and cluster spatial units into contiguous regions with similar characteristics. Our evaluation demonstrates that these methods achieve higher temporal stability compared to traditional approaches that aggregate directly over administrative boundaries. The findings highlight the importance of spatial modeling in optimizing Internet performance distribution for policy and planning.

Despite significant investments in access network infrastructure, universal access to high-quality Internet connectivity remains a challenge. Policymakers often rely on large-scale, crowdsourced measurement datasets to assess the distribution of access network performance across geographic areas. These decisions typically rest on the assumption that Internet performance is uniformly distributed within predefined social boundaries, such as zip codes, census tracts, or neighborhood units. However, this assumption may not be valid for two reasons: (1) crowdsourced measurements often exhibit non-uniform sampling densities within geographic areas; and (2) predefined social boundaries may not align with the actual boundaries of Internet infrastructure. In this paper, we present a spatial analysis on crowdsourced datasets for constructing stable boundaries for sampling Internet performance. We hypothesize that greater stability in sampling boundaries will reflect the true nature of Internet performance disparities than misleading patterns observed as a result of data sampling variations. We apply and evaluate a series of statistical techniques to: (1) aggregate Internet performance over geographic regions; (2) overlay interpolated maps with various sampling unit choices; and (3) spatially cluster boundary units to identify contiguous areas with similar performance characteristics. We assess the effectiveness of the techniques we apply by comparing the similarity of the resulting boundaries for monthly samples drawn from the dataset. Our evaluation shows that the combination of techniques we apply achieves higher similarity compared to directly calculating central measures of network metrics over census tracts or neighborhood boundaries. These findings underscore the important role of spatial modeling in accurately assessing and optimizing the distribution of Internet performance, which can better inform policy, network operations, and long-term planning decisions.

Many problems in computer networking rely on parsing collections of network traces (e.g., traffic prioritization, intrusion detection). Unfortunately, the availability and utility of these collections is limited due to privacy concerns, data staleness, and low representativeness. While methods for generating data to augment collections exist, they often fall short in replicating the quality of real-world traffic In this paper, we i) survey the evolution of traffic simulators and generators and ii) propose the use of state space models, specifically Mamba, for packet-level, synthetic network trace generation by modeling it as an unsupervised sequence generation problem. Preliminary evaluation shows that state space models can generate synthetic network traffic with higher statistical similarity to real traffic than the state-of-the-art. Our approach thus has the potential to reliably generate realistic and informative synthetic network traces for downstream computer networking tasks.