Tracegram: Framing Trace-Level Traffic Analysis with Temporally-Aware Multiple Instance Learning

Modern network behaviors span multiple flows and evolve over time, making temporal and co-occurrence contexts across flows essential for reliable traffic analysis. This need is especially critical in the security domain, where attacks progress through reconnaissance, delivery, command and control, and lateral movement over extended intervals and across multiple flows. Existing packet-level or single-flow approaches fragment this context and limit performance on trace-level classification, detection, and attribution. We introduce the trace as the analysis unit and present Tracegram, which formulates trace-level analysis as Multiple Instance Learning. Tracegram combines per-flow encoders with a temporally aware aggregation module to reason across flows, preserve long-range dependencies, and produce key-flow attribution signals that support analyst verification and forensics. Our validation spans theory and practice. We theoretically justify the MIL-based decomposition for trace-level traffic analysis and conduct extensive experiments on four public datasets across multiple tasks, showing better or comparable performance to state-of-the-art methods. Finally, case studies on APT traces from the DAPT dataset show that Tracegram highlights flows aligned with attack phases, enabling targeted investigation. The source code and datasets for Tracegram are publicly available at https://doi.org/10.5281/zenodo.17978903 .