Source-linked AI summary
Decompose to Understand, Fuse to Detect: Frequency-Decoupled Anomaly Detection for Encrypted Network Traffic
Xinglin Lian, Chengtai Cao, Ting Zhong, Yong Wang, Kai Chen, Fan Zhou
TL;DR
Encrypted traffic exhibits full-frequency structure, while reconstruction models favor low-frequency information, creating a spectral mismatch that harms anomaly representations. FreeUp separates low- and high-frequency processing and dynamically fuses branch uncertainty; experiments show consistent improvements over state-of-the-art baselines across multiple datasets.
Problem
Encrypted traffic contains significant high-frequency information, but reconstruction-based detectors exhibit low-frequency bias, creating a spectral mismatch that limits anomaly representations.
Method
FreeUp decomposes traffic into low- and high-frequency bands, learns them in separate branches with frequency-specific training, and dynamically fuses their reconstruction uncertainties.
Results
FreeUp consistently outperforms state-of-the-art baselines across multiple encrypted-traffic benchmarks, with AUC improvements exceeding 3% on CIC-IoT2023 and DoHBrw2020 and reaching 95% on ISCX-Tor2016.
Takeaways & Limitations
Frequency-decoupled representations and uncertainty-aware fusion provide a more comprehensive evaluation of anomalies in full-frequency encrypted traffic.
Abstract
from arXiv · showhide
Network traffic anomaly detection represents a critical cybersecurity task, yet widespread encryption makes this task increasingly challenging. In response, image-based methods that model traffic as visual patterns have emerged as the dominant approach. However, this work pioneers the identification of a pervasive ``full-frequency'' characteristic and an associated limitation termed ``spectral mismatch'' within this paradigm. Specifically, while encrypted traffic exhibits prominent high-frequency components, mainstream reconstruction methods demonstrate an inherent bias toward learning low-frequency information. This fundamental mismatch results in incomplete representations that consequently degrade anomaly detection performance. To address this challenge, we propose FreeUp, a novel frequency-decoupled framework designed explicitly for encrypted traffic analysis. FreeUp decomposes traffic data into distinct low- and high-frequency bands, processing them through separate, dedicated branches along with a customized training strategy that ensures stable and independent frequency-specific learning. Furthermore, recognizing that simple reconstruction error proves inadequate for evaluating dual-branch architectures, we introduce an uncertainty-inspired fusion scoring mechanism. This mechanism quantifies the reconstruction uncertainty of the frequency-specific branches and dynamically integrates their outputs, yielding a more comprehensive and reliable anomaly score. Extensive experiments across multiple benchmarks demonstrate that FreeUp consistently outperforms state-of-the-art baselines. The code is available at https://github.com/ikun0124/FreeUp.
I. INTRODUCTION
Encrypted traffic makes anomaly detection harder because encryption obscures payload features, while traffic images contain full-frequency information that reconstruction models incompletely capture. FreeUp addresses this mismatch through frequency-specific learning and uncertainty-aware fusion, outperforming state-of-the-art methods across multiple benchmarks.
- Encryption obscures packet-payload features, weakening traditional methods for distinguishing normal from malicious traffic.
- Encrypted traffic images exhibit full-frequency characteristics, whereas reconstruction models tend to favor low-frequency information, creating spectral mismatch.This mismatch produces incomplete representations and unreliable anomaly identification.
- FreeUp decomposes traffic images into complementary low- and high-frequency bands and processes them through independent frequency-constrained branches.The design focuses each branch on one frequency component and provides a stable reconstruction signal.
- An uncertainty-inspired fusion mechanism adaptively integrates uncertainty from the frequency branches into a more comprehensive anomaly score.The approach models reconstruction uncertainty independently for each branch before fusion.
- FreeUp significantly outperforms state-of-the-art methods in experiments across multiple benchmark datasets.
II. MOTIVATION
Frequency analysis distinguishes encrypted traffic images from natural images and exposes a spectral mismatch in standard reconstruction-based anomaly detection. Natural images concentrate energy at low frequencies, whereas encrypted traffic retains substantial information across the spectrum, motivating frequency-decoupled modeling.
- A. Full Frequency Phenomenon: Natural images show low-frequency dominance, with energy concentrated at low frequencies and sharply reduced high-frequency content.Low-frequency components capture semantic structures and outlines, while high-frequency components encode details, textures, and edges.
- A. Full Frequency Phenomenon: Encryption disrupts byte-level semantics and creates noise-like traffic images whose spectral composition differs from natural imagery.
- A. Full Frequency Phenomenon: Encrypted traffic images preserve significant information across frequency bands, producing the paper’s full-frequency phenomenon.
- B. Motivation: The Inherent Conflict: Autoencoders’ spectral bias toward low frequencies causes standard reconstruction models to capture low-frequency traffic patterns while neglecting important high-frequency information.This creates the spectral mismatch that limits representation quality for encrypted traffic.
III. PRELIMINARIES
FreeUp frames encrypted-traffic anomaly detection as zero-positive learning over normal-sample distributions and addresses spectral mismatch through frequency-decoupled reconstruction. It separates low- and high-frequency views, reconstructs them independently, and uses complementary information and frequency-aware constraints to improve representation completeness.
- FreeUp learns normal-sample distributions and assigns higher anomaly scores to test samples with greater anomaly likelihood.
- Traffic flows are converted into image-like tensors by reshaping packet bytes and concatenating packet images chronologically.
- Frequency Decoupling: Fourier analysis motivates separating encrypted traffic into low- and high-frequency views because standard reconstruction models exhibit spectral mismatch.
- Frequency-constrained Auto-encoder: The two frequency-specific views are independently reconstructed, allowing each autoencoder to model its assigned spectrum without interference.
- Frequency-complement integration: Complementary input-side frequency components are integrated into reconstruction branches as auxiliary information, providing a more complete frequency basis.
- Frequency-constrained Reconstruction: The reconstruction objective combines spatial and frequency constraints to suppress frequency leakage and enforce frequency consistency.
B. Uncertainty-inspired Fusion
FreeUp replaces scalar reconstruction-error scoring with evidential uncertainty modeling for each frequency branch. It then dynamically fuses the branches into a unified distribution whose uncertainty incorporates confidence and inter-view disagreement.
- Evidential learning models the reconstruction uncertainty distribution independently for each frequency branch instead of relying only on scalar reconstruction errors.
- Normal Inverse-Gamma distributions represent the uncertainty of the low- and high-frequency reconstructions, with higher-order parameters predicted from each reconstruction.
- The evidential objective minimizes marginal-likelihood negative log likelihood and penalizes excessive evidence when reconstruction quality is weak.
- Uncertainty Dynamic Fusion: Dynamic fusion addresses biased single-view scoring by adaptively combining branch confidences rather than using score averaging or static weights.
- Uncertainty Dynamic Fusion: The fused uncertainty jointly reflects individual branch uncertainty and the discrepancy between low- and high-frequency reconstructions.
C. Training
FreeUp jointly trains frequency-specific and fused branches with reconstruction and uncertainty-estimation objectives. This design treats accurate reconstruction as a prerequisite for reliable uncertainty quantification and propagates all loss components together.
- Accurate reconstruction of both frequency branches is treated as essential for reliable uncertainty estimation.
- Each branch combines reconstruction loss with negative log likelihood and an overconfidence-penalty term.
- The total objective includes frequency-specific and fused losses, which are jointly backpropagated to learn separate and integrated representations.
D. Inference
During inference, FreeUp fuses frequency-branch evidential parameters into an integrated distribution and uses its epistemic uncertainty as the anomaly score. The resulting score reflects combined confidence and uncertainty across frequency components.
- The frequency branches are fused into NIG(exf, vf, αf, βf), an integrated evidential representation.
- FreeUp uses the variance of the fused distribution’s mean as the anomaly score, with higher variance indicating greater uncertainty.
A. Experimental Setups
FreeUp is evaluated on three public encrypted-traffic datasets using standard anomaly-detection metrics and established sampling protocols. The comparison includes baseline methods and reports results over repeated runs.
- Datasets and metrics: Evaluation uses CIC-IoT2023, DoHBrw2020, and ISCX-Tor2016, covering IoT intrusion, HTTPS malicious traffic, and anonymous traffic scenarios.Training uses 10,000 normal instances; testing uses 5,000 normal and 5,000 anomalous instances.
- Datasets and metrics: Performance is measured with AUROC, Accuracy, and F1-Score under established network-anomaly-detection practices.
- Baselines: FreeUp is compared against nine state-of-the-art baselines spanning two categories.
- Reproducibility: Results are averaged over five independent runs with different random seeds for statistical robustness.
B. Main Results
FreeUp consistently outperforms the evaluated baselines across datasets and metrics. The results support frequency-decoupled modeling and multi-view uncertainty-based fusion for encrypted traffic anomaly detection.
- Overall comparison: FreeUp consistently outperforms all baselines across datasets and evaluation metrics by substantial margins.It achieves AUC improvements of over 3% on CIC-IoT2023 and DoHBrw2020, and up to 95% AUC on ISCX-Tor2016.
- Interpretation: Frequency decoupling supports complete pattern understanding and multi-view evidence modeling for uncertainty-inspired evidential learning.The fusion method adaptively integrates anomaly evaluations from different frequency perspectives.
- Spatial–spectral analysis: Frequency-constrained learning is evaluated through spatial–spectral comparisons of the reconstructed traffic representations.
- Baseline limitations: Low-pass approaches discard high-frequency information, producing incomplete anomaly evidence and unreliable detection results.The paper contrasts these methods with FreeUp’s use of full-frequency traffic information.
C. Frequency Decoupling Study
The studies examine frequency-branch ablations, dynamic anomaly-score fusion, and hyperparameter sensitivity. Results favor retaining both frequency branches, using dynamic uncertainty fusion, and selecting P = 8 and D = 5.
- Frequency decoupling: Removing either frequency branch causes a noticeable detection-performance drop, while removing frequency decoupling causes the largest degradation.The ablations support modeling both low- and high-frequency information.
- Frequency decoupling: Removing the frequency-constrained loss also reduces performance, supporting its role in frequency-specific branch learning.
- Dynamic fusion: Static product and weighted-sum fusion can fail to improve performance and may degrade it, whereas dynamic uncertainty fusion integrates branch signals adaptively.
- Hyperparameter sensitivity: P = 8 provides the best trade-off between insufficient context from too few packets and noise from too many.
- Efficiency: The study includes an inference-overhead comparison for the evaluated methods.
- Hyperparameter sensitivity: D = 5 provides the most suitable separation extent for the low- and high-frequency branches.D controls the Gaussian-filter bandwidth used for frequency decoupling.
F. Overhead Analysis
FreeUp offers a lightweight alternative to several competitive detection approaches, while its dual-branch design incurs higher overhead than UnDiff. Its parallelizable branches and concise components improve practical runtime efficiency despite this cost.
- Efficiency comparison: FreeUp demonstrates promising efficiency compared with MFR and ARCADE through its concise autoencoder and lightweight evidential-learning framework.The comparison uses multiply-accumulate operations per second (#MACs) and model parameters (#Paras).
- Efficiency comparison: Transformer-based TSLANet incurs high computational costs from attention operations, while NeuTral and MCM require multiple models and therefore increase parameter overhead.
- Efficiency comparison: FreeUp has roughly three times UnDiff’s overhead, but the paper reports that this cost is offset by superior detection performance.
- Deployment efficiency: FreeUp’s dual branches can be deployed in parallel with minimal memory usage, improving practical runtime efficiency.