Explainable Rule Mining of IPv6 Extension-Header Presence Patterns from Paired-Vantage Captures

2026-10-06

AI Summary

This study addresses the challenge in IPv6 extension header behavioral feature extraction, where intra-packet co-occurrences are frequently misidentified as cross-packet dynamic temporal patterns. Leveraging the JAMES dataset, this work mines interpretable temporal logic rules and introduces a novel negative control protocol alongside a sender-conditioned retention measurement to diagnose spurious temporal patterns and verify the existence of genuine network-level temporal structures. The findings reveal that the dominant fragmentation signals stem from definitional intra-packet co-occurrences rather than authentic network temporal dynamics. This conclusion is corroborated through cross-validation with decision tree and large language model baselines. Furthermore, the research provides a suite of controlled verification tools, enabling reliable and honest negative findings in network traffic analysis.

Abstract

IPv6 extension headers (EHs), such as fragmentation, segment routing, and in-situ telemetry, are operationally important yetwidely dropped in transit, and characterising their behaviour from packet captures is a recurring measurement problem. We ask whetheran explainable miner can recover human-readable rules of EH behaviour, and we contribute two reusable tools: a negative-control protocol that diagnoses whether a mined "temporal" network rule reflects genuine cross-packet dynamics or mere within-packetco-occurrence, and a sender-conditioned, per-family EH-retention measurement. Applying an interpretable temporal-logic rule miner to the JAMES paired-vantage dataset, we recover a portable Fragment-EH rule that the protocol reveals to be a within-packet,near-definitional co-occurrence rather than a temporal pattern, so the temporal-logic machinery does no work for this dominant rule;the retention measurement independently recovers the expected within-window ordering of EH observability. Our main result istherefore an honest, controlled negative finding, corroborated by executed decision-tree and large-language-model baselines: on theevaluated JAMES traces network-temporal structure does not carry the dominant Fragment-EH signal, and we supply the controls thatestablish when it would, validated on a synthetic positive control containing a genuine cross-packet dependency.

Problem

• IPv6 extension headers
• explainable rule mining
• packet captures
• temporal patterns
• network measurement

Innovation

• Explainable Rule Mining
• IPv6 Extension Headers
• Negative-Control Protocol
• Temporal Logic
• Paired-Vantage Captures