Abstract:Encrypted traffic classification plays a critical role in network security and management. Currently, mining deep patterns from side-channel contents and plaintext fields through neural networks is a major solution. However, existing methods have two major limitations: (1) They fail to recognize the critical link between transport layer mechanisms and applications, missing the opportunity to learn internal structure features for accurate traffic classification. (2) They assume network traffic in an unrealistically stable and singular environment, making it difficult to effectively classify real-world traffic under environment shifts. In this paper, we propose FG-SAT, the first end-to-end method for encrypted traffic analysis under environment shifts. We propose a key abstraction, the Flow Graph, to represent flow internal relationship structures and rich node attributes, which enables robust and generalized representation. Additionally, to address the problem of inconsistent data distribution under environment shifts, we introduce a novel feature selection algorithm based on Jensen-Shannon divergence (JSD) to select robust node attributes. Finally, we design a classifier, GraphSAT, which integrates GraphSAGE and GAT to deeply learn Flow Graph features, enabling accurate encrypted traffic identification. FG-SAT exhibits both efficient and robust classification performance under environment shifts and outperforms state-of-the-art methods in encrypted attack detection and application classification.

Seq2Path: a Sequence-to-path-based Flow Feature Fusion Approach for Encrypted Traffic Classification

FusionTC: Encrypted App Traffic Classification Using Decision-Level Multimodal Fusion Learning of Flow Sequence

MT-FlowFormer: A Semi-Supervised Flow Transformer for Encrypted Traffic Classification

Seeing Traffic Paths: Encrypted Traffic Classification With Path Signature Features

BFSN: A Novel Method of Encrypted Traffic Classification Based on Bidirectional Flow Sequence Network

A Novel Algorithm for Encrypted Traffic Classification Based on Sliding Window of Flow's First N Packets

FG-SAT: Efficient Flow Graph for Encrypted Traffic Classification under Environment Shifts

SAFSN: A Self-Attention Based Neural Network for Encrypted Mobile Traffic Classification

Flow-Based User Click Identification in Encrypted Web Traffic.

Flow-based Encrypted Network Traffic Classification with Graph Neural Networks

IP Packet-Level Encrypted Traffic Classification Using Machine Learning with a Light Weight Feature Engineering Method

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

An encrypted traffic identification method based on multi-scale feature fusion

Rethinking Encrypted Traffic Classification: A Multi-Attribute Associated Fingerprint Approach

TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-grained Encrypted Traffic Classification

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

Bidirectional Flow-Based Image Representation Method for Detecting Network Traffic Service Categories

Comparison and Analysis of Flow Features at the Packet Level for Traffic Classification

Flow Transformer: A Novel Anonymity Network Traffic Classifier with Attention Mechanism

Multi-Granularity Feature Fusion for Enhancing Encrypted Traffic Classification

End-to-end encrypted traffic classification with one-dimensional convolution neural networks