Explainable Rule Mining of IPv6 Extension-Header Presence Patterns from Paired-Vantage Captures

arXiv:2610.08090v1 Announce Type: cross Abstract: IPv6 extension headers (EHs), such as fragmentation, segment routing, and in-situ telemetry, are operationally important yetwidely dropped in transit, and characterising their behaviour from packet captures is a recurring measurement problem. We ask whetheran explainable miner can recover human-readable rules of EH behaviour, and we contribute two reusable tools: a negative-control protocol that diagnoses whether a mined "temporal" network rule reflects genuine cross-packet dynamics or mere within-packetco-occurrence, and a sender-conditioned, per-family EH-retention measurement. Applying an interpretable temporal-logic rule miner to the JAMES paired-vantage dataset, we recover a portable Fragment-EH rule that the protocol reveals to be a within-packet,near-definitional co-occurrence rather than a temporal pattern, so the temporal-logic machinery does no work for this dominant rule;the retention measurement independently recovers the expected within-window ordering of EH observability. Our main result istherefore an honest, controlled negative finding, corroborated by executed decision-tree and large-language-model baselines: on theevaluated JAMES traces network-temporal structure does not carry the dominant Fragment-EH signal, and we supply the controls thatestablish when it would, validated on a synthetic positive control containing a genuine cross-packet dependency.

Related

• CT-Miner: Fast and Coarse-Grained Time-Series Pattern Mining via Cartesian Trees
• Mining Negative Sequential Patterns to Improve Viral Genomic Feature Representation and Classification
• MV-Gate: Insider Threat Detection via Multi-View Behavioral Statistics and Semantic Modeling

Source: arXiv cs.LG | 2026-10-07