For each extracted TCP connection, we record the sequence of size, arrival time tuples for each packet in the connection, in arrival order. We encode the packet’s direction in the sign bit of the packet’s size, so that packets sent from server to client have size less than zero and those from client to server have size greater than zero. Since the traces in this data set consist mostly of unencrypted, non-tunneled TCP connections, a few additional preprocessing steps are necessary to simulate the more challenging scenarios which our techniques are designed to address. To simulate the effect of encryption on the traffic in our data.
