PaperlayerView exact revision on arXiv

Source-linked AI summary

TDDM-Melatt: A Decoupled Memory and Diffusion Framework for Generalizable Encrypted Traffic Classification

Ze Chen, Qiming Yu, Zijia Song, Guozheng Yang, Wei Yan

arXiv:2608.30745v1cs.LG

TL;DR

Encrypted traffic classification must overcome shortcut learning from non-causal identifiers and severe long-tail imbalance that weaken real-world generalization. TDDM-Melatt combines a decoupled memory representation model, anonymization and frozen-encoder inference, and traffic-specific diffusion augmentation. Across four public datasets and multiple classification tasks, it achieves superior performance, with TDDM improving F1-score by up to 9.98%.

  • Problem

    Encrypted traffic classification suffers from shortcut learning caused by non-causal identifiers and from long-tail class imbalance, weakening generalization to real-world traffic.

  • Method

    TDDM-Melatt combines Melatt's decoupled memory representation learning with strict topology anonymization, frozen-encoder classification, and traffic-specific diffusion augmentation.

  • Results

    Up to 9.98% improvement in F1-score was achieved by TDDM data augmentation, alongside superior performance across multiple classification tasks.

  • Takeaways & Limitations

    The framework provides a new paradigm for encrypted traffic classification characterized by high accuracy, strong generalization, and rapid adaptability.

  • Takeaways & Limitations

    Real-world network complexity exceeds laboratory datasets, and the framework's memory adaptation to dynamic traffic and incremental-learning capabilities remain insufficient.

Abstract

from arXiv · show

The widespread adoption of encrypted traffic poses severe challenges to current security situational awareness systems based on network traffic monitoring. In existing dataset-driven training and testing studies, limitations such as shortcut learning induced by spurious feature correlations and sample imbalance caused by the long-tail distribution of real-world traffic result in weak generalization of traffic identification performance to real-world network traffic. To address these limitations, we propose TDDM-Melatt, a disentangled memory-based traffic classification framework with diffusion-based data augmentation. First, we design Melatt, a memory-decoupled traffic representation model, which employs Competitive Gating Long Short-Term Memory (CG-LSTM) to construct the encoder and decoder. We design a spurious-correlation-free pre-training and inference paradigm, employing strict topology anonymization and a frozen pre-trained encoder strategy to cut off the model's learning pathways for spurious features. During inference, classification is performed efficiently by a downstream classifier on the frozen representations. Second, we propose a Traffic Denoising Diffusion Model (TDDM) tailored to the characteristics of traffic data. Extensive experiments are conducted on 4 representative public benchmark datasets. Under strict flow-level splitting and anonymization, TDDM-Melatt outperforms 6 basic classification models and 6 SOTA representation learning models. The proposed method provides a new and effective technical pathway for encrypted traffic classification in real-world network environments.

1 Introduction

Encrypted traffic monitoring is hindered by ineffective payload inspection, shortcut learning from non-causal identifiers, and severe class imbalance. TDDM-Melatt addresses these limitations through decoupled memory representation learning and traffic-specific diffusion augmentation.

  • Motivation: Encryption limits traditional Deep Packet Inspection, motivating deep learning approaches for encrypted traffic monitoring.More than 80% of Internet communications reportedly use encryption protocols.
  • Motivation: Public datasets preserve identifiers such as IP, Port, and flow IDs that encourage models to learn non-causal shortcut features.Packet-level splitting can distribute packets from one flow across training and test sets, amplifying this problem.
  • Motivation: Extreme traffic imbalance causes majority classes to dominate training, while generic GANs and diffusion models struggle with traffic-specific structure.GANs are prone to training instability and mode collapse, and traffic diffusion remains insufficiently adapted to structured data.
  • Proposed framework: TDDM-Melatt proposes Melatt, a modular traffic memory model using a CG-LSTM encoder and a memory-augmented multi-head cross-attention decoder.The architecture is designed to extract and reconstruct dynamic traffic information.
  • Proposed framework: The framework anonymizes explicit flow identifiers, generalizes timestamps, freezes the pretrained encoder for downstream classification, and uses TDDM for structured traffic augmentation.TDDM reduces feature dimensionality by more than 30% and uses class-wise training with condition-guided compact noise sampling.

2 Problem Statement

Encrypted traffic classification faces generalization failures from shortcut learning, long-tail class distributions, and scenario-bound models. The paper frames the research task as escaping spurious correlations while adapting across scenarios and generating high-fidelity minority samples.

  • Research challenges: Payload-based DPI is increasingly ineffective for TLS 1.3 and QUIC, prompting a shift toward representation-learning-based encrypted traffic classification.The cited comparison appears in Table 1.
  • Shortcut learning: Existing supervised approaches often learn non-causal IP, Port, and flow-ID correlations, causing performance to collapse when deployment environments differ.Packet-level partitioning can further expose models to flow-specific idiosyncrasies rather than class-generalizable patterns.
  • Shortcut learning: Full fine-tuning can erode generic pretrained features and increase reliance on training-set-specific shortcuts under environment shifts.The passage describes a tension between retaining pretrained generalization benefits and adapting to downstream data.
  • Class imbalance: Long-tail traffic distributions let majority classes dominate training, skewing decision boundaries and reducing recognition of rare but security-relevant minority samples.Benign and popular-application traffic may outnumber malicious or niche traffic by several orders of magnitude.
  • Research objective: The stated research question combines robustness to spurious correlations, extreme data distributions, rapid cross-scenario adaptation, and high-fidelity traffic generation.The proposed response is a decoupled memory and diffusion framework.

3 Methodology Overview

The framework separates traffic representation learning, minority-class synthesis, and downstream classification into modular components. Melatt performs memory-based encoding and reconstruction, while TDDM generates class-conditioned samples tailored to structured traffic data.

  • Framework architecture: The framework contains Melatt, TDDM, and a downstream task classifier as three modular components.Melatt is the pretraining architecture; TDDM independently synthesizes minority-class traffic conditioned on class labels.
  • Melatt: Melatt comprises an encoder, external memory module, and decoder that perform encoding, memory-bank addressing, and reconstruction decoding.Its design decouples feature extraction from knowledge storage through learnable memory matrices and content-based addressing.
  • Downstream classification: The downstream classifier is flexible, supporting lightweight traditional models and complex deep architectures for different deployment scenarios.The stated scenarios include resource-constrained edge devices and high-performance servers.
  • TDDM: TDDM is tailored to high-dimensional, sparse, interdependent traffic features rather than directly transplanting generic generative architectures.The design includes feature selection based on Random Forest Gini importance to prune redundant features.

4 Methodological Details

Melatt combines CG-LSTM sequence modeling with an external prototype memory and memory-guided decoding. Its training constraints structure latent representations, while TDDM reduces feature dimensionality by over 30% using a 95% cumulative-importance threshold.

  • Encoder Based on Competitive Gating LSTM: CG-LSTM replaces independent gate activations with joint softmax gating, enforcing a finite budget across forgetting, input, and output operations.This design is described as mitigating memory confusion and supporting minority-class feature acquisition.
  • Encoder Based on Competitive Gating LSTM: The stacked CG-LSTM encoder converts a traffic sequence into a latent vector z_t that initializes decoding and queries the memory module.The final hidden state provides a global temporal fingerprint before projection, normalization, and activation.
  • Decoder Based on Cross-Attention: The decoder combines CG-LSTM outputs with multi-head cross-attention over external memory prototypes, followed by residual connections, normalization, and reconstruction.The memory matrix supplies keys and values, while local decoder features serve as queries.
  • Memory Model: Melatt separates temporal feature extraction from knowledge storage through learnable memory matrices with content-based addressing and independently manageable prototype slots.The external memory stores class-related prototypes, while the encoder focuses on extracting temporal features.
  • Memory Model and Pre-training Constraints: Negative-entropy regularization sharpens memory attention, while compactness, reconstruction, and other pre-training constraints organize latent features around memory prototypes.Smooth L1 reconstruction loss is used for robustness to outliers and stable convergence.

5 Evaluation

Evaluation across six tasks and multiple baselines shows that TDDM-Melatt generalizes well, while its memory and diffusion components provide task-dependent benefits at measurable computational cost.

  • Evaluation Setup: Six classification tasks across three datasets evaluate binary, multi-class, and fine-grained scenarios against six classifiers and six SOTA representation models.Binary tasks do not use TDDM; minority classes in the remaining tasks are augmented when their sample size is below 15% of the largest class.
  • Classification Performance: TDDM-Melatt achieves consistently superior performance across multi-scenario traffic classification tasks, whereas unconstrained baseline classifiers deteriorate on harder multi-class tasks.The results are reported under the paper’s comparative evaluation of baseline classifiers and representation-learning models.
  • Generation Performance: On VPN-16class and USTC-20class, generative-model gains are negligible or harmful, with synthetic data potentially adding noise to majority-class training dynamics.For binary VPN-2class and USTC-20class tasks, TDDM-Melatt does not augment data and matches Melatt’s performance.
  • Generation Performance: TDDM is the sole method with statistically significant gains on VPN-6class and TLS-120class, improving F1-score by 5.56% and 9.98%, respectively.Other generative baselines provide no notable enhancement on these two tasks.
  • Memory Ablation: Melatt features achieve the highest AC and F1 across all six classifiers, outperforming raw features and an autoencoder without memory-based content addressing.The memory module is reported to capture and match deep behavioral and anomalous traffic patterns for downstream classification.
  • Memory Ablation: Melatt component contributions grow with task difficulty: removing any component drops F1 by less than 0.2% on USTC-20class but substantially affects TLS-120class.The reported Macro F1 values are 96.56% for USTC-20class and 58.10% for TLS-120class.
  • Efficiency Analysis: The memory module adds 50%–110% feature-extraction overhead, reaching 104.59% on TLS-120class, while Melatt with XGBoost extracts features in under 12 ms per sample.The overhead is reported as below 80% for other tasks, and the decoupled design supports the inference-latency advantage.

6 Discussion

The discussion attributes generalization failures primarily to misaligned learning objectives and benchmark overfitting, not insufficient model capacity. It also identifies important limits of augmentation transfer and real-world deployment.

  • Discussion: The authors argue that encrypted traffic generalization is bottlenecked by learning-objective misalignment and changing real-world feature distributions, rather than insufficient model capacity.The framework shifts emphasis from dataset-specific performance toward universal behavioral prototypes.
  • Discussion: TDDM-Melatt reframes traffic classification from fitting training distributions to learning universal behavioral prototypes through memory decoupling.This paradigm is presented as a response to benchmark overfitting.
  • Data augmentation: TDDM requires traffic-specific design choices, including feature selection, class-wise training, centroid-guided sampling, and nearest-neighbor padding, rather than direct transplantation of generic generators.The authors report that these strategies address structured traffic data more effectively than blindly transferred image-generation architectures.
  • Data augmentation: Data augmentation has limited overall benefit when majority-class performance approaches saturation, motivating imbalance-aware losses and training strategies beyond sample generation.The authors explicitly caution that augmentation is not a panacea.
  • Limitations: TDDM effectiveness is not uniformly transferable across base models, suggesting compatibility depends on the base model’s representation-learning paradigm.The authors identify this disparity as a limitation discussed in Appendix C.
  • Limitations: The authors acknowledge that laboratory datasets underrepresent real-world network complexity, while memory adaptation and incremental learning remain insufficient.These gaps define future work toward more interpretable and generalizable cybersecurity systems.

7 Related Work

Related work applies deep learning to encrypted traffic representation and classification, while data augmentation methods address imbalance with varying ability to model traffic structure. Conventional interpolation and generic generative approaches remain limited by traffic’s temporal, nonlinear, and structured properties.

  • Encrypted traffic classification: CNNs capture local packet-length patterns, whereas LSTM, GRU, ET-BERT, and YaTC model temporal, pretrained-language, or long-range dependencies.These methods represent major deep-learning directions in encrypted traffic classification.
  • Data augmentation: SMOTE and ADASYN generate synthetic traffic through feature-space interpolation but struggle with complex temporal dependencies and nonlinear traffic characteristics.Their samples may lack semantic coherence and introduce noise that degrades performance.

8 Conclusion

TDDM-Melatt addresses spurious correlations and class imbalance through decoupled memory representations, shortcut-suppressing training, and traffic-tailored diffusion augmentation. Across four public datasets and multiple tasks, it reports superior performance and up to a 9.98% F1-score improvement.

  • Conclusion: TDDM-Melatt combines CG-LSTM-based decoupled memory representation, spurious-correlation-free pretraining and inference, and traffic-structured denoising diffusion augmentation.The framework targets both insufficient generalization and class imbalance in real-world encrypted traffic classification.
  • Conclusion: TDDM-Melatt achieves superior performance across multiple classification tasks on four public datasets.The conclusion reports this as the framework’s principal experimental outcome.
  • Conclusion: 9.98% is the maximum reported improvement in F1-score from TDDM data augmentation.Ablation studies also validate the effectiveness of each core component.
  • Conclusion: The paper presents TDDM-Melatt as a new paradigm characterized by high accuracy, strong generalization, and rapid adaptability for encrypted traffic classification.This conclusion is stated within the scope of the reported public-dataset experiments.

A Preprocessed Statistical Features

The appendix supplements the main manuscript with a complete list of preprocessed statistical features and full feature-importance charts across four classification tasks. It also collects figures and tables omitted from the main text for space reasons.

  • Preprocessed Statistical Features: Figure 12 presents full TDDM-generated feature-importance bar charts for VPN-16class, TLS-120class, VPN-6class, and USTC-20class.These charts complement the complete preprocessed feature list.
  • Preprocessed Statistical Features: Table 8 lists the complete set of 76 preprocessed statistical features.The table is presented as an appendix reference for the feature set.
  • Appendix organization: The appendix collects figures and tables omitted from the main text because of page constraints, streamlining the manuscript’s core illustrations.Its purpose is supplementary presentation rather than introducing a separate experimental section.

B.1 Per-class Performance on USTC-20class

Figure 11 supplements Figure 5 by reporting both Accuracy (AC) and F1-score for TDDM-Melatt across USTC-20class traffic classes.

  • Figure 11 reports per-class Accuracy (AC) and F1-score metrics for TDDM-Melatt on USTC-20class.Figure 5 presents only per-class F1-scores, making Figure 11 its supplementary counterpart.

B.2 Comparison of Reverse Denoising Processes

The figures compare guided and unguided reverse denoising diffusion processes across traffic datasets and timesteps.

  • Figure 13 compares guided and unguided reverse denoising diffusion across IDS, USTC, and TLS over more timesteps.UG denotes unguided and G denotes guided denoising.
  • Figure 7 visualizes guided and unguided denoising for partial classes on the IDS and TLS datasets.

C Discussion on Model Generalization Limitations

TDDM’s augmentation effectiveness depends on compatibility between the base model’s representation paradigm and the augmented features, rather than transferring uniformly across models.

  • Model Generalization Limitations: TDDM is not uniformly transferable across base models because it was originally designed to adapt to Melatt.
  • Model Generalization Limitations: Differences in preprocessing paradigms and feature representations are identified as sources of the models’ differing responses to TDDM.
  • Model Generalization Limitations: ET-BERT benefits from complementary statistical patterns, whereas YaTC and NetMamba are more tightly coupled to training-data feature distributions.
  • Model Generalization Limitations: The paper calls for model-aware augmentation strategies that account for interactions between data augmentation and model architecture.
Loading 2608.30745v1…