Exploring QUIC Dynamics: A Large-Scale Dataset for Encrypted Traffic Analysis

TL;DR

This paper introduces VisQUIC, a comprehensive large-scale dataset of encrypted QUIC traffic with decryption keys and diverse implementations, enabling advanced machine learning analysis and benchmarking for network security and performance research.

Contribution

We present VisQUIC, a novel dataset with SSL keys, multiple QUIC implementations, and a new image-based representation for encrypted traffic analysis, supporting reproducible benchmarking.

Findings

Achieved 97% accuracy in estimating HTTP/3 responses from encrypted traffic.

Provided a large-scale, labeled dataset with decryption keys and diverse implementations.

Enabled machine learning analysis of encrypted QUIC traffic.

Abstract

The increasing adoption of the QUIC transport protocol has transformed encrypted web traffic, necessitating new methodologies for network analysis. However, existing datasets lack the scope, metadata, and decryption capabilities required for robust benchmarking in encrypted traffic research. We introduce VisQUIC, a large-scale dataset of 100,000 labeled QUIC traces from over 44,000 websites, collected over four months. Unlike prior datasets, VisQUIC provides SSL keys for controlled decryption, supports multiple QUIC implementations (Chromium QUIC, Facebooks mvfst, Cloudflares quiche), and introduces a novel image-based representation that enables machine learning-driven encrypted traffic analysis. The dataset includes standardized benchmarking tools, ensuring reproducibility. To demonstrate VisQUICs utility, we present a benchmarking task for estimating HTTP/3 responses in encrypted QUIC traffic, achieving 97% accuracy using only observable packet features. By publicly releasing VisQUIC, we provide an open foundation for advancing encrypted traffic analysis, QUIC security research, and network monitoring.