Source-linked AI summary
TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-grained Encrypted Traffic Classification
Haozhen Zhang, Le Yu, Xi Xiao, Qing Li, Francesco Mercaldo, Xiapu Luo, Qixu Liu
TL;DR
Existing encrypted-traffic classifiers rely on flow-level features or treat headers and payloads equally, limiting representation of short flows and byte correlations. The paper constructs PMI-based byte-level traffic graphs and introduces TFE-GNN with separate header/payload embedding, GNN encoding, and cross-gated fusion; experiments show it outperforms baselines on the WWT and ISCX datasets.
Problem
Existing methods extract flow-level features or treat packet headers and payloads equally, limiting encrypted-traffic representation for classification.
Method
The paper constructs byte-level traffic graphs using PMI and applies TFE-GNN, which separately embeds headers and payloads, encodes graphs with stacked GraphSAGE, and fuses features.
Results
TFE-GNN comprehensively surpasses the selected baselines on the WWT and ISCX datasets for encrypted traffic classification.
Takeaways & Limitations
The approach provides packet-level overall representation vectors for downstream tasks such as traffic classification and performs effectively on user behaviour classification.
Takeaways & Limitations
The graph topology is fixed before training, byte-level noise is not handled, and explicit temporal characteristics of byte sequences are unused.
Abstract
from arXiv · showhide
Encrypted traffic classification is receiving widespread attention from researchers and industrial companies. However, the existing methods only extract flow-level features, failing to handle short flows because of unreliable statistical properties, or treat the header and payload equally, failing to mine the potential correlation between bytes. Therefore, in this paper, we propose a byte-level traffic graph construction approach based on point-wise mutual information (PMI), and a model named Temporal Fusion Encoder using Graph Neural Networks (TFE-GNN) for feature extraction. In particular, we design a dual embedding layer, a GNN-based traffic graph encoder as well as a cross-gated feature fusion mechanism, which can first embed the header and payload bytes separately and then fuses them together to obtain a stronger feature representation. The experimental results on two real datasets demonstrate that TFE-GNN outperforms multiple state-of-the-art methods in fine-grained encrypted traffic classification tasks.
1 INTRODUCTION
Encrypted traffic complicates detection because privacy-preserving technologies conceal traffic sources and undermine traditional inspection and flow-statistics methods. The paper addresses this challenge with byte-level graphs and TFE-GNN, which separately models headers and payloads before evaluating the resulting representation on multiple datasets.
- Encrypted traffic limits traditional inspection because packet-content patterns and keywords become difficult to use accurately.
- Flow-statistics methods require hand-crafted features and can fail when statistical information is unreliable or unstable.
- TFE-GNN constructs byte-level traffic graphs using PMI and separately embeds packet headers and payloads before fusing their representations.
- The paper evaluates TFE-GNN against existing methods on self-collected WWT and public ISCX datasets for encrypted traffic classification.
2 PRELIMINARIES
The paper formulates encrypted traffic classification over packet and byte sequences, using traffic segments as flexible samples and GNN message passing to update node representations. Its notation distinguishes graph structure, node features, temporal packet order, and downstream category prediction.
- A graph G consists of nodes V, edges E, and node features X, with adjacency matrix A indicating whether node pairs are connected.
- A traffic segment is an ordered packet sequence with timestamps, and it can represent either a flow or a broader time-induced sample.
- Encrypted traffic classification predicts one of N categories for an unseen byte-sequence sample using a trained end-to-end model.
- Message-passing GNNs iteratively compute and aggregate neighborhood messages to update node embedding vectors across layers.
3 METHODOLOGY
TFE-GNN converts packet bytes into compact PMI-based graphs, processes header and payload separately with graph encoders, and fuses their representations for downstream traffic classification.
- 3.1 Byte-level Traffic Graph Construction: Each byte sequence becomes a graph whose nodes represent byte values, with at most 256 shared nodes and PMI-based edges connecting positively correlated bytes.Edges are created only when PMI(i,j) > 0; byte values initialize node features, and the graphs are undirected.
- 3.2 Dual Embedding: Because header and payload bytes can have different meanings, TFE-GNN constructs separate graphs and uses non-shared dual embedding layers for them.The header describes packet contents, whereas the payload carries transmitted content, motivating separate parameterized embeddings.
- 3.3 Traffic Graph Encoder with Cross-gated Feature Fusion: The traffic graph encoder stacks GraphSAGE layers that aggregate normalized neighbor messages, concatenate them with node features, and apply nonlinear transformations.PReLU is used as the activation, and batch normalization plus a maximum of four layers address deep-GNN over-smoothing concerns.
- 3.3 Traffic Graph Encoder with Cross-gated Feature Fusion: Layer outputs are concatenated and mean-pooled across nodes to produce separate header and payload graph vectors, g_h and g_p.The resulting graph vectors summarize the two packet components before fusion.
- 3.3 Traffic Graph Encoder with Cross-gated Feature Fusion: Cross-gated fusion generates sigmoid gates from each graph vector and crosswise filters the two vectors before concatenating them into packet representation z.The mechanism is designed to filter unimportant information and retain significant information for downstream tasks.
- 3.4 End-to-End Training on Downstream Tasks: Packet representations z form a sequence for downstream classification, with bidirectional two-layer LSTM and transformer models considered for segment-level prediction.The training loss is cross entropy, and the primary focus is segment-level classification.
4 EXPERIMENTS
The experiments evaluate TFE-GNN across multiple encrypted-traffic datasets, baselines, components, architectures, complexity settings, and hyper-parameters.
- Experimental Design: Experiments investigate component usefulness, GNN architecture, model complexity, and hyper-parameter sensitivity through four stated research questions.The study explicitly organizes these analyses as RQ1 through RQ4.
- Datasets: TFE-GNN is evaluated on ISCX VPN-nonVPN, ISCX Tor-nonTor, and a self-collected WWT dataset.The datasets cover VPN, Tor, and fine-grained user-behavior traffic scenarios.
- Datasets: ISCX VPN-nonVPN and ISCX Tor-nonTor contain six and eight user-behavior categories, respectively, while WWT covers WhatsApp, WeChat, and Telegram behaviors.WWT contains twelve, nine, and six categories for the three applications, respectively.
- Data Preparation: The preprocessing removes payload-free samples, overlong samples exceeding 10,000 packets, Ethernet headers, and identifying IP addresses and port numbers.These filters support graph construction and reduce interference from sensitive addressing information.
- Evaluation: Performance is measured using Overall Accuracy, Precision, Recall, and Macro F1-score against traditional feature-engineering, deep-learning, and graph-neural-network baselines.The comparison uses four evaluation metrics across the selected datasets.
4.2 Comparison Experiments
TFE-GNN achieves strong performance across the WWT and ISCX comparison experiments, including a substantial advantage on Telegram. Its ablation results show that separate header–payload processing and several architectural operations materially affect classification performance.
- TFE-GNN reaches the best performance on WWT and the best results on four reported metrics.
- 10.82% f1-score improvement over the second highest is achieved by TFE-GNN on Telegram.The authors attribute this result to TFE-GNN’s byte encoding capability, while VPN use and background noise make Telegram classification difficult.
- TFE-GNN outperforms GraphDApp and ECD-GNN across the reported comparison aspects.
- 2.5% and 21.06% f1-score decreases occur when switching from headers to payloads on ISCX-VPN and ISCX-Tor, respectively.The ablation indicates that headers contribute more to classification, with the magnitude differing across datasets.
- 3.63% and 0.95% f1-score increases result from dual embedding on the two datasets.JKN-like concatenation and cross-gated feature fusion also improve performance by similar margins across the datasets.
- 11.1% and 29.64% f1-score losses occur for element-wise summation instead of mean aggregation on the two datasets.GRU worsens all metrics by about 10%, while a transformer drops f1-score by within about 1% on ISCX-Tor and almost 40% on ISCX-VPN.
4.4 GNN Architecture Variants Study (RQ2)
The architecture-variant study compares classical GNN choices within the temporal fusion encoder across three datasets. GraphSAGE performs best, while other variants—especially GAT—show lower f1-scores in the small-graph setting.
- The study evaluates GAT, GIN, GCN, and SGC as classical GNN architecture variants on Telegram, ISCX-VPN, and ISCX-Tor.
- GraphSAGE achieves the best f1-score on Telegram, ISCX-VPN, and ISCX-Tor.
- GAT shows a particularly noticeable f1-score decline among the evaluated GNN variants.The authors relate this decline to attention-based neighborhood aggregation exacerbating overfitting on graphs with up to 256 nodes.
- The TFE-GNN architecture can incorporate segment-level global features shared across nodes alongside local packet context.The passage describes concatenation, element-wise addition, and similar operations as ways to add this global information.
4.5 Model Complexity Analysis (RQ3)
TFE-GNN improves public-dataset performance while adding relatively little model complexity. Its sensitivity varies with embedding dimension, PMI window size, and segment length.
- Model Complexity: TFE-GNN achieves the most significant improvement on public datasets with relatively slight increases in model complexity.The comparison considers FLOPs and parameter counts for the baselines.
- Model Complexity: ET-BERT has approximately five times TFE-GNN’s FLOPs and twice its model parameters on ISCX-nonVPN.The paper associates this difference with longer inference time and greater computation-resource requirements.
- Sensitivity Analysis: F1-score rises rapidly below an embedding dimension of 100, then stabilizes; the default dimension is 50 to reduce computation.This sensitivity result is shown for the dual embedding layer.
- Sensitivity Analysis: Smaller PMI windows and shorter training segments generally produce better F1-scores.Larger windows create denser graphs, while longer segments introduce more noise and expose LSTM shortcomings.
5 RELATED WORK
Related encrypted-traffic classifiers use engineered statistics, deep sequence models, raw-byte models, pre-training, or graph neural networks. These approaches differ in their inputs and representation-learning strategies.
- Traditional Feature Engineering Based Methods: Traditional methods use handcrafted flow statistics such as packet lengths, intervals, cumulative lengths, and payload lengths with machine-learning classifiers.Examples include AppScanner, CUMUL, GRAIN, and ETC-PS.
- Deep Learning Based Methods: Deep learning methods extract features from packet headers, packet-length and delay sequences, raw bytes, or large-scale pre-training data.The reviewed models include MLP, CNN, RNN, GRU, autoencoder, and pre-training approaches.
- Graph Neural Network Based Methods: Graph-based methods construct traffic graphs from bursts, flows, or time slices and learn representations with graph neural networks.GraphDApp and MAppGraph are cited examples.
6 CONCLUSION AND FUTURE WORK
The paper proposes byte-level traffic graphs and TFE-GNN for encrypted traffic classification, encoding packets into representations for downstream tasks. Experiments on WWT and ISCX report broad superiority over the evaluated baselines, while future work targets graph construction and temporal modeling limitations.
- Conclusion: The proposed byte-level graph construction mines correlations between raw bytes, and TFE-GNN extracts high-dimensional features from the resulting graphs.The model encodes each packet into an overall representation vector usable for downstream tasks such as traffic classification.
- Conclusion: TFE-GNN comprehensively surpasses all evaluated baselines on the WWT and ISCX datasets.The paper states that elaborately designed experiments demonstrate strong effectiveness.
- Future Work: Future improvements target fixed, potentially non-optimal graph topology, byte-level noise, and the lack of explicit temporal characteristics in byte sequences.These limitations concern both graph construction and temporal information use.
A THREAT MODEL AND ASSUMPTIONS
The threat model assumes normal users communicate with remote servers through mobile apps while a passive attacker captures packets and infers user behavior without decrypting or modifying them.
- Threat Model: The attacker is a passive observer who captures target-app packets by compromising the device or sniffing the network link.The attacker cannot decrypt or modify packets and analyzes them to infer normal-user behavior.
B LONG-TAILED DISTRIBUTION OF THE ISCX DATASET
Flow lengths in the ISCX-VPN, ISCX-NonVPN, and ISCX-NonTor datasets generally follow a long-tailed distribution, with only part of the sorted data shown because of the dataset size.
- Flow lengths generally obey a long-tailed distribution across the ISCX-VPN, ISCX-NonVPN, and ISCX-NonTor datasets.
- The figure presents only part of the sorted data because of the amount of data.