ANT Dataset Scores What Encrypted Agent Traffic Reveals

Researchers released ANT, a 104.07 GB corpus of 3,114 agent executions aligned with 276,417 bidirectional flows for behavior auditing. Thirteen traffic-analysis methods were scored on risk identification, scene identification, and 47-class behavior primitive classification.

Why agent traffic is observable

The paper ANT: A Multi-Granularity Network Traffic Dataset and Benchmark for Agents Behavior Auditing measures how far an AI agent's task and behavior can be inferred from traffic produced during a run. Agents call models, use tools, and interact with external systems. Those steps generate network traffic. Packet length, direction, and timing remain visible when payloads are encrypted.

Paper: https://arxiv.org/abs/2610.06514

Dataset: https://huggingface.co/datasets/benzenenene/ANT

Collection system and benchmark code: https://anonymous.4open.science/r/ant-main-suite-7BC0/

Agent network traffic characteristics

A single agent task includes model calls, tool use, and analysis of returned results. The authors map a question-answering run onto the matching traffic.

In execution semantics, the run splits into behavior primitives. Each primitive serves one sub-goal and usually includes model-backend communication, tool calls, and analysis of tool output. Traffic for one primitive can therefore mix model communication and tool operations.

Aligning the execution timeline with the packet timeline shows traffic bursts near the start of primitives. Traffic mix and interaction patterns change when the sub-goal and tools change. In the WebSearch stage of the example, traffic is mainly agent-to-model-backend communication, because the Harness strategy delegates search to the model backend. In the WebFetch stage, the agent retrieves a given URL, which adds DNS lookups and page-download traffic. Both stages gather information, but execution method and network interaction differ.

ANT aligns traffic with execution records and labels the overall task plus per-stage behavior.

Dataset construction

ANT records 3,114 agent executions, 276,417 bidirectional flows, and 104.07 GB of network traffic. Coverage includes five agent configurations, 20 task types, and five scenes: code and data engineering, general knowledge question answering, scientific evidence assessment, interactive application operation, and cybersecurity abuse.

Data collection system

The team deployed automated collection on two cloud servers, one in China and one overseas. Before each run, the system prepared the working directory and runtime, issued a natural-language task, and started the agent. The agent called models, used tools such as web search or shell commands, and continued until it produced a final reply. The system recorded timestamps for model calls, tool use, tool output, and session state, and captured all packets with tcpdump into PCAP files. Logs and traffic were aligned by timestamp so later primitive segmentation had a shared clock.

Each task instance ran in an isolated virtual network namespace so concurrent jobs would not mix traffic. The agent could access only the current working directory and required runtime, blocking shortcuts such as reading pre-stored answers instead of retrieving data over the network. Benign tasks that change state used local simulated services. Attack executions ran inside isolated Docker environments to protect collection servers and external production systems.

Behavior primitive annotation

The team split traffic by start times in session logs, extracted behavior primitives from log evidence, and clustered 40,049 primitive segments into 47 macro classes with Jina Embeddings v5 and spherical K-means.

Primitive distribution and order reflect task scenes. Tasks in the same scene are closer in primitive semantic distribution and macro-class proportions. Distances fall 15.46% and 14.79% versus cross-scene tasks. A control that kept primitive types and counts but shuffled order showed that real sequences have stronger within-scene similarity.

Benchmark evaluation

Three tasks run from coarse to fine.

Risk identification: decide from traffic whether agent activity is malicious, as an input to abuse controls.

Scene identification: from a full execution's traffic, decide the task class, such as general question answering, scientific evidence assessment, or interactive application operation.

Behavior primitive classification: from a local traffic segment, assign one of 47 macro classes.

Thirteen encrypted-traffic classification and website-fingerprinting methods were compared.

Risk identification

All 13 methods exceeded 90% overall accuracy. Seven methods had malicious-class recall below 50%.

Web penetration tasks that include scanning and injection-style network interaction left clearer traffic clues. Malicious code generation and sandbox evasion sit more in code content and intent, so their observable traffic is closer to normal coding tasks. YaTC, NetMamba, TFusion, and TrafficFormer had very low detection on the latter two task types and near-1 detection on web penetration.

Scene identification

Accuracy across five scenes ranged from 43.1% to 72.7%. NetMamba had the highest accuracy. General knowledge question answering and scientific evidence assessment were the main confusion pair. Both include retrieval, reasoning, and answer generation. Across baselines, 35.1% of scientific evidence assessment samples were labeled general knowledge question answering, and 22.8% of general knowledge question answering samples were labeled scientific evidence assessment.

Keeping only model-call traffic raised average accuracy by 5.56 percentage points versus full traffic. Removing model-call traffic lowered average accuracy by 4.31 percentage points, to about 54.7%. Model calls carry strong scene signal, and remaining traffic still carries useful signal. Removing representative primitive traffic cut average accuracy by 6.95 percentage points. Removing non-representative primitive traffic cut it by 3.77 percentage points.

Behavior primitive classification

Eight methods scored 35.5% to 46.2% accuracy when assigning a segment to one of 47 macro classes. The ten most frequent classes were 72.44% of test segments and 91.34% to 96.09% of each model's correct predictions. Nearby classes such as search, page fetch, and API query were also confused. Existing methods are more reliable on common classes and on classes with distinctive traffic patterns. Rare classes and semantically close classes remain hard.

Outlook

ANT joins agent network traffic with task metadata and behavior primitive labels, and offers a benchmark for traffic analysis methods on agent traffic. Current methods capture distinctive traffic patterns. They still fail on rare behaviors and on semantic differences that are weakly expressed in traffic. Mapping those identifications to concrete execution behavior is a base for later network-side agent auditing and forensics.