PTEF-84K: Leakage-Audited Portless Packet-Telemetry Feature Dataset for Service-Intent Inference

This record contains the released de-identified CSV feature dataset supporting the study of leakage-audited portless service-intent inference from packet telemetry under locked external-domain validation. The dataset contains 84,498 reconstructed packet records collected across 60 controlled capture sessions and 10 acquisition populations. Nine acquisition populations were used as development populations, contributing 74,131 packet records across 54 sessions. One independently held-out acquisition population was reserved as a locked external validation population, contributing 10,367 packet records across 6 sessions. The released records are organized for five service-intent classes: Web, DNS, Other, Diagnostics, and Local_Network. The class distribution is: Web: 61,470 records (72.7%); DNS: 11,368 records (13.5%); Other: 7,937 records (9.4%); Diagnostics: 3,199 records (3.8%); and Local_Network: 524 records (0.6%). The public feature tables were prepared for leakage-audited machine-learning evaluation. Main-model inputs exclude source and destination ports, IP addresses, MAC addresses, DNS query strings, hostnames, URLs, raw payload bytes, raw textual packet summaries, absolute timestamps, session identifiers, and acquisition-population identifiers. Session and population metadata are retained only where needed for evaluation splitting, reproducibility checks, and locked external validation, not as model features. The released archive includes de-identified packet-level feature tables and public portless feature matrices suitable for reproducing the dataset-level analyses, benchmark inputs, class distributions, and external-validation split used in the associated manuscript. Raw PCAPNG packet-capture files are not publicly released in this record because packet captures may contain endpoint metadata and timing-sensitive information. Instead, this record provides the de-identified feature representation intended for open reuse. Associated manuscript:“Portless Temporal Evidence Forests for Leakage-Audited Service-Intent Inference under Locked External-Domain Validation.” DOI:10.5281/zenodo.20737820