[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-85088-en":3,"doc-seo-85088-105":29,"detail-sidebar-cat-0-en-105":83},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},85088,687197207057,"Sage","https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0",8,"Research & Report","Applying JEPA-Style Predictive Learning to JA4-Derived Network Fingerprints","I-JEPA and V-JEPA learn by aligning latent predictions with target encoder outputs rather than reconstructing the input, and this strategy has shown strong results for images and video. The work investigates whether a similar objective applies to compact network fingerprints. It introduces JA4-JEPA, a Transformer-based JEPA model trained on JA4, JA4H, JA4S, and JA4X subfields from JA4DB and CIC-IDS-2017. Using a frozen kNN probe for protocol-family classification across TLS, DNS, and SSH on 39,416 samples, the model reaches 0.9899 cosine similarity and 0.9220 kNN accuracy.","Applying JEPA-Style Predictive Learning to JA4-Derived Network  \nFingerprints  \nAygul Zagidullina  \nLucerne University of Applied Sciences and Arts (HSLU) [aygul. zagidullina@hslu. ch](aygul. zagidullina@hslu. ch)  \nJavier Izquierdo  \nLucerne University of Applied Sciences and Arts (HSLU) [javier. izquierdo@stud. hslu. ch](javier. izquierdo@stud. hslu. ch)  \narXiv :2607 .08465v 1 [ cs .AI] 9 Jul 2026  \nAbstract  \nI-JEPA and V-JEPA learn by matching latent predictions to target encoder outputs rather than regenerating the original input, and this has worked well for images and video. We explore whether the same objective works for compact network fingerprints. We built JA4-JEPA, a Transformer-based model trained on JA4, JA4H, JA4S, and JA4X subfields drawn from JA4DB and CIC-IDS- 2017. The training data combines roughly 397K samples from both sources, though no single sample contains all four view families. We evaluated the learned representations with a frozen kNN probe on protocol-family classification across TLS, DNS, and SSH. On 39,416 heldout samples the model achieved a cosine similarity of 0.9899 and a kNN accuracy of 0.9220 . These results indicate that JEPA-style predictive learning can produce useful embeddings from JA4-derived fingerprints, even with incomplete view overlap across sources. Keywords: JA4, network fingerprinting, JEPA, predictive representation learning, self-supervised learning  \n1 Introduction  \nNetwork fingerprints like JA3 and JA4 compress protocol handshake details into short identifiers that are cheap to store and fast to match. However, these fingerprints are mostly used as static lookup keys. They do not, on their own, give us a learned representation that could generalize across different analysis tasks.  \nI-JEPA and V-JEPA showed that predicting target representations in latent space, instead of reconstructing the raw input, can learn strong features from images and video (Assran et al., 2023; Bardes et al., 2024) . We wanted to know if the same predictive approach could work on a very different kind of data: compact network fingerprints derived from JA4+ .  \nTo test this, we built JA4-JEPA, a Transformer-based JEPA model trained on JA4, JA4H, JA4S, and JA4X subfields from two sources: JA4DB and CIC-IDS-2017 . The combined dataset has roughly 397K tokenized samples, but modality overlap is incomplete — no single sample contains all four view families, and JA4 is often the only view shared across sources.  \nWe evaluated the learned representations through a frozen kNN probe on protocol-family classification over  \nTLS, DNS, and SSH. The model produces useful embeddings on this task despite the incomplete view overlap in the training data. The main contributions are:  \n• An adaptation of JEPA-style predictive learning to JA4-derived network fingerprints.  \n• A mixed-source training setup over JA4, JA4H, JA4S, and JA4X where modality coverage varies across samples and no sample has complete view overlap.  \n• Evaluation showing that frozen embeddings from this model support protocol-family classification on held-out TLS, DNS, and SSH data.  \n• A matched-baseline anomaly benchmark on a production pilot corpus of 2.1M gateway fingerprint pairs, comparing the prediction-energy signal against frequency, nearest-neighbour, autoencoder, reconstruction, and clustering baselines under one leakagefree protocol, including a training-set size sweep (Section 4.5) .  \nThe motivation for this work is practical. Standard fingerprinting treats each signature as a lookup key, while flow-level or packet-level models require much heavier input. A model that learns from several compact fingerprint views could sit in a useful middle ground—lightweight inputs, but richer than single-signature matching.  \nSection 2 reviews related fingerprinting and representation learning work. Sections 3 and 4 describe the model and report the probe results. Section 5 discusses what these results support and where the gaps remain.  \n","cbCaiccMdy1KqOQk","https://ap.wps.com/l/cbCaiccMdy1KqOQk","pdf",433512,1,6,"English","en",105,"# Introduction\n# Related Work","[{\"question\":\"How are the learned representations evaluated and what performance is reported?\",\"answer\":\"A frozen kNN probe performs protocol-family classification across TLS, DNS, and SSH. On 39,416 held-out samples, the model achieves 0.9899 cosine similarity and 0.9220 kNN accuracy.\"}]",1784201022,15,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":78,"head_meta":80,"extra_data":82,"updated_unix":27},"applying-jepa-style-predictive-learning-to-ja4-derived-network-fingerprints","",{"@graph":35,"@context":77},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/applying-jepa-style-predictive-learning-to-ja4-derived-network-fingerprints/85088/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71],{"name":72,"@type":73,"acceptedAnswer":74},"How are the learned representations evaluated and what performance is reported?","Question",{"text":75,"@type":76},"A frozen kNN probe performs protocol-family classification across TLS, DNS, and SSH. On 39,416 held-out samples, the model achieves 0.9899 cosine similarity and 0.9220 kNN accuracy.","Answer","https://schema.org",{"og:url":51,"og:type":79,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":81,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":84},[85,89,93,97,102,106,111,114,119,122,126],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":86,"show_sort_weight":87,"slug":88},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":90,"show_sort_weight":91,"slug":92},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Exam",70,"exam",{"id":98,"doc_module":4,"doc_module_name":45,"category_name":99,"show_sort_weight":100,"slug":101},5,"Comic",60,"comic",{"id":21,"doc_module":4,"doc_module_name":45,"category_name":103,"show_sort_weight":104,"slug":105},"Technology",50,"technology",{"id":107,"doc_module":4,"doc_module_name":45,"category_name":108,"show_sort_weight":109,"slug":110},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":112,"slug":113},30,"research-report",{"id":115,"doc_module":4,"doc_module_name":45,"category_name":116,"show_sort_weight":117,"slug":118},9,"Religion & Spirituality",20,"religion-spirituality",{"id":117,"doc_module":4,"doc_module_name":45,"category_name":120,"show_sort_weight":117,"slug":121},"World Cup","world-cup",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":123,"slug":125},10,"Lifestyle","lifestyle",{"id":127,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":98,"slug":129},19,"General","general"]