How chatradhara007/bigpac works
BigPAC classifies encrypted QUIC applications from early packet sizes, directions and timing. Its primary workflow captures QUIC flows, derives SNI labels for training data, trains the v2 model, then predicts from live or replayed traffic; the web demo separately replays held-out flows. The graph also preserves the documented CESNET/original-model evaluation and legacy live classifier. Some wiring is based on README descriptions because those modules were not sampled.
Main entry points: live_capture_v2.py Live classifier · train_v2.py v2 training · app.py Web demo · pcap_to_dataset.py Capture converter
Components 23
Capture and labels
- Capture files
- Capture converter
pcap_to_dataset.py - Labelled live flows
- Live capture
live_capture_v2.py - QUIC SNI reader
quic_sni.py
Features and training
- CESNET flows
- Shared features
features.py - v2 training
train_v2.py - Trained model
- Live evaluation
eval_live.py
Prediction runtime
- Live classifier
live_capture_v2.py - Prediction log
results/live_log.csv - Web demo
app.py - Held-out flows
- Demo interface
static/script.js
Original pipeline
- Original training
model_pipeline.py - Processed flows
- Original live classifier
live_capture.py - Accuracy visualizer
visualizer.py
Other components
- Operator
- QUIC traffic
- Demo user
- tshark
Connections 30
- Operator → Capture converter: converts captures
- Capture files → Capture converter: reads captures
- Capture converter → tshark: extracts packet fields
- Capture converter → Labelled live flows: writes labelled flows
- QUIC traffic → Live capture: supplies packets
- Live capture → QUIC SNI reader: reads Initials
- CESNET flows → v2 training: training input
- Labelled live flows → v2 training: training input
- v2 training → Shared features: computes features
- v2 training → Trained model: saves model
- Operator → v2 training: runs training
- QUIC traffic → Live classifier: supplies packets
- Live classifier → QUIC SNI reader: reads server name
- Live classifier → Shared features: computes features
- Live classifier → Trained model: loads model
- Live classifier → Prediction log: writes predictions
- Demo user → Demo interface: uses demo
- Demo interface → Web demo: requests samples and predictions
- Web demo → Held-out flows: loads held-out flows
- Web demo → Shared features: computes features
- Web demo → Trained model: loads model
- Processed flows → Original training: training input
- Original training → Trained model: saves original models
- QUIC traffic → Original live classifier: supplies packets
- Original live classifier → Processed flows: collects flow samples
- Operator → Live evaluation: runs evaluation
- Labelled live flows → Live evaluation: evaluation input
- Trained model → Live evaluation: loads model
- Operator → Accuracy visualizer: runs visualization
- Original training → Accuracy visualizer: provides experiment results