PaperlayerView exact revision on arXiv

Source-linked AI summary

Pruned Traffic Trees: Native Semantic Compression with a Protocol-Structured Model Family for Encrypted Traffic Classification

Yuantu Luo, Jun Tao, Xiangyu Xu, Linxiao Yu, Kangying Li

arXiv:2608.21874v1cs.NIcs.AI

TL;DR

Encrypted traffic classification needs compact models that retain meaningful protocol evidence and structural context, which conventional parameter- or representation-level compression does not explicitly select. PTT treats native protocol structures as compression units, using salience-guided hierarchy preservation, sparse execution, and flow-level adaptation; its variants achieve strong Macro-F1 with substantially lower resource use.

  • Problem

    Existing ETC compression methods mainly operate on weights, channels, hidden representations, or predictions rather than explicitly selecting retained protocol fields and structural contexts.

  • Method

    PTT uses complete Protocol Tree Graphs to learn field salience, preserve required paths with TopK+k closure, execute experts according to protocol presence, and derive narrower models through structure-aligned transfer and logits distillation.

  • Results

    PTT-Lite retains 0.9325 and 0.9136 Macro-F1 while reducing parameters, effective GFLOPs, and CPU latency relative to the Full models on the two evaluated datasets.

  • Takeaways & Limitations

    Treating protocol structure as the compression object provides practical Full, Distilled, and Lite operating points with strong performance–resource trade-offs for lightweight ETC.

Abstract

from arXiv · show

Deep learning has achieved strong performance in encrypted traffic classification (ETC), yet its computational cost limits deployment on resource-constrained network devices such as routers and middleboxes. Existing compression methods mainly operate on weights, channels, hidden representations, or predictions, but do not explicitly determine which protocol fields and structural contexts should remain. We propose Pruned Traffic Trees (PTT), a three-level protocol-structured model family that treats native protocol structures as compression units. PTT-Full learns protocol-structured representations and field salience from complete Protocol Tree Graphs (PTGs), with flow-level self-supervised learning and protocol-presence-aware sparse execution. The learned salience and TopK+$k$ closure construct Distilled PTGs (PTG-Ds) for PTT-Distilled, while PTT-Lite inherits this topology and reduces width through structure-aligned transfer and flow-level logits distillation. Under flow-disjoint and Strong Information Information (SII)-masked settings, PTT-Full achieves Macro-F1 scores of 0.9519 and 0.9416 on CSTNET-TLS1.3 and CipherSpectrum, while PTT-Lite retains 0.9325 and 0.9136 with 80.3\% and 61.3\% fewer parameters, 98.85\% and 98.78\% lower effective GFLOPs, and 8.75$\times$ and 8.46$\times$ CPU inference speedups. These results demonstrate that treating protocol structure itself as the compression object enables effective performance-efficiency trade-offs for lightweight ETC.

I. INTRODUCTION

PTT makes native protocol fields and their hierarchy explicit compression units for encrypted traffic classification. Its model family combines salience-guided structural pruning, flow-level learning, and protocol-presence-aware sparse execution.

  • Motivation: Existing ETC representations and compression methods do not explicitly preserve protocol field boundaries, hierarchy, or the protocol evidence retained by compact classifiers.Fixed-length representations can add padding or remove information, while conventional compression mainly targets weights, channels, representations, or predictions.
  • PTT model family: PTT builds on Protocol Tree Graphs (PTGs) to make parsed fields and parent–child relations an explicit compression interface.The approach treats protocol fields and their native hierarchy as semantic units for representation, sparse execution, and compression.
  • PTT model family: Learned field salience selects retained fields, while TopK+k closure restores required protocol paths for compact Distilled PTGs.The resulting hierarchy-closed structure preserves the native protocol context of retained evidence.
  • PTT-Full: PTT-Full combines flow-level self-supervised learning with protocol-presence-aware sparse dispatch, executing experts only for present protocol components.The method uses protocol presence as an explicit routing signal rather than routing over anonymous learned tokens or branches.
  • PTT variants: PTT-Lite inherits compressed topology from PTT-Distilled and reduces width through structure-aligned transfer and flow-level logits distillation.Experiments on two TLS 1.3 datasets use flow-disjoint and SII-masked settings to evaluate transferable traffic patterns without flow leakage or shortcut indicators.

B. Protocol-Presence-Aware Sparse MoE

PTT-Full uses protocol presence to activate only relevant experts and cooperative fusion to combine simultaneously present protocol components. Gather–execute–scatter makes this routing computationally effective at packet and flow scale.

  • Flow-Centric Batching: Variable-length packet sets from sampled flows are concatenated into macro-batches without packet padding, while flow identifiers preserve flow-level regrouping.The sampler selects up to NB flows, and outputs can be regrouped for flow-level learning.
  • Protocol Presence: Protocol presence determines whether an expert can execute, with IP and TCP-core retained as structural anchors for the TCP-based flows considered.Active packet indices are gathered into expert-specific subbatches.
  • Sparse Dispatch and Fusion: Gather–execute–scatter skips absent experts by gathering active packets, executing each nonempty expert once, and scattering outputs back to packet positions.Masking after a forward pass would not reduce computation; inactive positions are zero-filled.
  • Sparse Dispatch and Fusion: Sigmoid fusion allows coexisting protocol components such as IP, TCP, and TLS to contribute simultaneously.This differs from competitive softmax routing, which selects among alternatives.

C. Flow-Level Pretraining and Classification

PTT-Full learns at flow granularity by relating packets from the same flow during self-supervised pretraining and averaging packet outputs for supervised classification. Its trained backbone supplies the source information used for later compression.

  • Flow-Level Pretraining: Packets from each flow are pooled into a flow representation before applying the normalized temperature-scaled cross-entropy objective.The pretraining relation is defined at flow level rather than treating packets as independent samples.
  • Flow-Level Pretraining: Flow-level contrastive pretraining treats two perturbed views of one flow as a positive pair and representations from other flows as negatives.Packets from the same flow are never treated as negatives, and canonical PTGs, expert assignments, and presence masks are shared across views.
  • Supervised Classification: During supervised adaptation, the pretrained backbone is jointly fine-tuned with a classifier and packet logits are averaged within each flow.The resulting flow-level logits support the final class prediction objective.
  • Compression Source: The trained PTT-Full provides the high-capacity classifier and supplies field salience, PTG structure, and parameters for compression.These learned quantities support construction of the downstream compact model variants.

IV. PTG-NATIVE STRUCTURAL COMPRESSION

PTT performs native structural compression by pruning complete PTGs while preserving the protocol paths that provide context. PTT-Distilled and PTT-Lite form progressively smaller topology and width variants.

  • PTG-Native Structural Compression: PTT-Distilled selects salient fields and applies TopK+k closure to preserve their structural context when compressing PTGs.PTT-Lite inherits the compressed topology and further reduces representation width.
  • PTG-Native Structural Compression: PTG-native compression reduces protocol structure itself rather than merely masking computation on complete PTGs.Sparse dispatch skips absent experts, but active experts otherwise process complete PTGs before structural compression.

A. PTT-Full to PTT-Distilled

PTT-Full derives compact Distilled PTGs by ranking protocol fields with learned normalized salience and restoring the minimal parent hierarchy needed to preserve their context. PTT-Distilled then uses the compressed topology with structure-aligned parameter projection.

  • Salience-based selection: Normalized Field Salience ranks protocol fields within each expert for compression-oriented retention.The scores are used for field ranking rather than causal attribution.
  • Topology construction: TopK+k closure restores the minimal protocol hierarchy required to keep selected fields meaningful after compression.PTT recursively follows parent relations inherited from packet dissection.
  • Topology construction: The resulting core node set is hierarchy-preserving and uniquely minimal, with closure size determined by selected fields’ protocol paths rather than a fixed pruning ratio.Any smaller set would remove a selected field or an ancestor required by its original protocol path.
  • Topology construction: The closure algorithm prevents duplicate enqueuing and constructs each expert’s hierarchical edge set in O(|VF,e| + |EhierF,e|) time.Ancestor traversal visits each discovered node once.
  • Distilled model: PTT-Distilled retains PTT-Full’s expert set, anchor experts, and sparse dispatch rule while each active expert processes a smaller graph.The distilled model is initialized through structure-aligned channel selection after the PTG-D topology is fixed.

B. PTT-Distilled to PTT-Lite

PTT-Lite keeps the Distilled PTG topology unchanged and reduces representation width through aligned transfer, adaptation, and flow-level logits distillation. Shared field identities support structural alignment across stages.

  • Width reduction: PTT-Lite removes no protocol field and reduces representation width from dD to dL < dD.The distilled topology GD remains unchanged during this stage.
  • Width transfer: PTT-Distilled and PTT-Lite share PTG-D schemas and expert organization, aligning node-specific parameters for width transfer.The shared structure provides the basis for transferring parameters between stages.
  • Width transfer: Structure-aligned projection selects top-dL channels consistently across aligned modules before the narrower fusion and classifier adapt.Projected experts are briefly frozen while the narrower components adapt, followed by joint fine-tuning.
  • Logits distillation: Flow-level logits distillation guides the lower-capacity Lite model with fixed predictions from PTT-Distilled without changing PTG-D topology.The teacher remains fixed during Lite adaptation.
  • Cross-stage alignment: PTT preserves field identities across Full, Distilled, and Lite models, providing a natural alignment for cross-stage parameter transfer.Compression decisions remain associated with concrete protocol fields and their original context.

A. Experimental Setup

The evaluation compares PTT variants with diverse ETC baselines on two TLS 1.3 datasets using identical flow-disjoint, SII-masked inputs and efficiency measurements. Performance–latency and compression effectiveness are examined alongside classification metrics.

  • Datasets and protocol: CSTNET-TLS1.3 contains encrypted sessions across 26 domains, while CipherSpectrum contains 120,000 TLS 1.3 sessions across 41 domains and three cipher suites.Both datasets use identical flow-disjoint splits and SII-masked packet traces.
  • Datasets and protocol: Input construction removes the complete ETH layer, IP addresses, transport ports, and server names, and PTT uses no composite TLS fingerprints such as JA3/JA4.These restrictions apply before constructing each model’s input representation.
  • Compared methods: The comparison includes PTT-Full, PTT-Distilled, and PTT-Lite alongside image-like, byte/sequence, graph, and PTGAMoE classifiers.Baselines are retrained under the same flow-disjoint splits and SII-masked inputs.
  • Metrics and inference: Accuracy and Macro-F1 measure classification, while Params, effective GFLOPs, CPU p50 latency, and flow throughput measure efficiency.Latency uses a macro-batch of 32 flows with at most 32 packets each; parsing and input construction are excluded.
  • Evaluation views: Figures 3 and 4 respectively examine performance–latency Pareto frontiers and compression effectiveness for the PTT family.The captions identify the two complementary evaluation views.

B. Overall Performance and CPU Efficiency

PTT achieves strong Macro-F1 while offering distinct Full, Distilled, and Lite operating points across performance, computation, latency, and throughput. Presence-aware masking improves modeling, while sparse execution converts absent protocol components into computation savings without changing predictions.

  • 0.9325 and 0.9136 Macro-F1 are retained by PTT-Lite on CSTNET-TLS1.3 and CipherSpectrum, respectively.PTT-Lite exceeds GAT by 0.0663 and 0.0821, respectively.
  • 0.0254 and 0.0707 Macro-F1 improvements over dense PTGAMoE accompany 3.17× and 3.50× lower macro-batch latency for PTT-Full.
  • 19.72% and 38.70% of Full-model parameters and 1.15% and 1.22% of effective GFLOPs are used by PTT-Lite across the two datasets.CPU speedups are 8.75× and 8.46×, respectively.
  • 24.7% and 48.8% GFLOPs reductions from sparse execution increase throughput by 36.6% and 91.6%, respectively, without changing predictions.Presence masking improves Macro-F1 before sparse execution is enabled.

E. Effect of PTG-Native Structural Compression

PTG-native compression outperforms matched model-level compression by selecting salient protocol fields and preserving their native hierarchical paths. Structural closure delivers substantial graph reduction while field-budget effects and selection stability define practical operating boundaries.

  • Model-Level versus PTG-Native Compression: 0.0220 and 0.0324 Macro-F1 gains at the Distilled budget increase to 0.0404 and 0.0743 at the Lite budget over model-level baselines.Full-PTG baselines have approximately 1.83× and 1.80× higher CPU latency at the Distilled and Lite budgets.
  • Field Guidance and Salience Stability: The learned gate salience produces the strongest compressed models under comparable graph-computation budgets.The field-selector comparison uses the same TopK+k closure and K = 5.
  • Field Guidance and Salience Stability: 0.4286 ± 0.1431 and 0.3982 ± 0.1536 average pairwise Jaccard similarities show that exact Top-5 selections remain seed-sensitive across the two datasets.Repeatedly selected fields form a more stable semantic core, while boundary fields may vary.
  • Protocol Closure and Case Study: TopK+k achieves complete protocol paths and the highest Macro-F1 on both datasets, whereas retaining ancestor nodes without original relations performs below Selected Fields Only.The comparison uses the same selected fields and distinguishes field selection from hierarchy preservation.
  • Structural Reduction and Field Budget: 53.66%–56.82% node reductions and 61.11%–64.10% edge reductions leave path completeness at 1.00 under K = 5.CSTNET-TLS1.3 reduces from 82 to 38 nodes and 72 to 28 edges; CipherSpectrum reduces from 88 to 38 nodes and 78 to 28 edges.
  • Structural Reduction and Field Budget: K = 5 is the common compact setting because CSTNET-TLS1.3 gains saturate around K = 5, while larger budgets substantially increase graph computation.CipherSpectrum benefits more consistently from additional fields and admits higher-accuracy points at K = 10 or K = all.

F. Effect of Cross-Stage Transfer

Cross-stage transfer adapts structurally compressed teachers to deployment-oriented Lite models through aligned initialization, logits distillation, and width selection. The benefits of these mechanisms vary by transition and dataset, supporting a balanced common width alongside accuracy-oriented alternatives.

  • Effect of Channel-Projection Initialization: 0.1085 and 0.0735 Macro-F1 gains from structure-aligned projection are obtained during Distilled-to-Lite transfer on CSTNET-TLS1.3 and CipherSpectrum.The corresponding Full-to-Distilled gains are 0.0183 and 0.0032.
  • Effect of Flow-Level Logits Distillation: 0.9325 Macro-F1 is reached on CSTNET-TLS1.3 when λKD = 0.10 raises performance from 0.9129.CipherSpectrum benefits only marginally at 0.05 and degrades under larger teacher weights.
  • Effect of Width Selection: 0.9346 Macro-F1 at 0.143 GFLOPs is achieved by CipherSpectrum with dL = 28, while dL = 28 adds computation without further gain on CSTNET-TLS1.3.The common balanced setting is dL = 20; dL = 28 remains an accuracy-oriented option for CipherSpectrum.
  • PTT-Lite inherits the compressed topology and combines structure-aligned transfer with flow-level logits distillation for deployment-oriented adaptation.The target PTG topology and model width are kept unchanged in the transfer experiments.
Loading 2608.21874v1…