SFR-M Flow Token Dataset and Embeddings (ISCX VPN-nonVPN)

This dataset contains flow-level representations derived from encrypted and non-encrypted network traffic, constructed according to the Symbolic Flow Representation based on the First-M packets (SFR-M) methodology. The data are based on the ISCX VPN-nonVPN traffic collection and include bidirectional flows generated from the first four packets per direction of each flow. For each packet, the first 64 bytes of the payload are extracted and converted into symbolic token sequences using two tokenization granularities (b=2 and b=8). The resulting flow-token datasets are provided in Parquet format, enabling efficient storage and scalable analysis.

In addition to the tokenized flow datasets, this collection also includes the corresponding embedding datasets generated from the symbolic tokens using a transformer-based sentence embedding model. Each flow is represented by a fixed-dimensional embedding obtained through packet-level encoding and flow-level aggregation, preserving directional information while avoiding explicit temporal features. The datasets support research on early traffic classification, VPN detection, and application-level traffic analysis, and are intended to facilitate reproducibility, benchmarking, and further studies on flow-based representations for encrypted network traffic.