Classify supplied synthetic device traffic patterns

Tune a transparent camera-candidate classifier on synthetic packet metadata and score unseen traces with false positives visible.

Radio Remi: predict first, inspect every intermediate value, and keep the claim inside the evidence., your practice guide

Radio Remi: predict first, inspect every intermediate value, and keep the claim inside the evidence.
Predict the reading, then compare it with the measurement.

Python 3 in your browser (JupyterLite)

Python · no install

Tune a transparent camera-candidate classifier on synthetic packet metadata and score unseen traces with false positives visible.

Tier 2 · Web · paste-in setup · No account

Version tested: Python 3.12.7 / Pyodide 0.27.6 in JupyterLite 0.6.4; captureSource playwright:jupyterlite. Date: 2026-09-22.

Open the notebook in your browser and run each Python cell; no install or account is needed.

Three ways to run: use JupyterLite here with no install; run main.py locally from the downloadable lab folder; or open the same notebook in Google Colab.

Open in your browser (new tab)

Steps

Screens captured against JupyterLite Python 3.12.7 / Pyodide 0.27.6; Chromium 148.0.7778.96 on 2026-09-22; the tool may have moved on — the text steps are the contract.

  1. Step 1

    Do
    Predict how a camera, phone, and smart plug might differ.
    You will see
    The three classes, packet count, seed, and synthetic boundary print.
    Why it matters
    These are statistical cues, not device names.

  2. Step 2

    Do
    Generate packet sizes and time gaps for each class.
    You will see
    Three labelled rows of sizes and inter-arrival gaps print.
    Why it matters
    Useful metadata features include packet-size distribution, uplink/downlink ratio, inter-arrival time, burst duration, duty cycle, and periodicity.

  3. Step 3

    Do
    Calculate median size, gap variation, and uplink share.
    You will see
    A three-row feature table prints each value.
    Why it matters
    Encryption can hide payload content while packet sizes, direction, and timing still reveal traffic patterns.

  4. Step 4

    Do
    Tune one size threshold using training traces only.
    You will see
    Three candidate thresholds print true and false counts.
    Why it matters
    Firmware updates, cloud retries, video buffering, background sync, and network congestion can imitate another class.

  5. Step 5

    Do
    Score the chosen rule on held-out synthetic traces.
    You will see
    True positives, false positives, false negatives, precision, and recall print.
    Why it matters
    These are statistical cues, not device names.

  6. Step 6

    Do
    Stress an upload-heavy phone case.
    You will see
    The altered feature values and camera-like prediction print.
    Why it matters
    A streaming camera often sends sustained uplink data with regular bursts, while a phone may alternate short interactive bursts and idle periods.

  7. Step 7

    Do
    Write a candidate and lawful-use result card.
    You will see
    The final card keeps metrics, false positives, synthetic provenance, and confirmation boundary together.
    Why it matters
    Combine independent clues only after naming the devices each method cannot see.

Chapter checks

These questions refer to the chapter’s examples. Use the return links to review their answers.

  1. What does a camera-like traffic classification establish?

    Return to the chapter’s knowledge check

  2. Why combine RF and optical checks during an authorised inspection?

    Return to the chapter’s knowledge check

Return to Detecting Hidden Cameras and Rogue Devices · Browse Labs