PaperlayerView exact revision on arXiv

Source-linked AI summary

NetLexicon: Learning Discrete Behavioral Representations for Encrypted Web Traffic Analysis

Xiangyu Gao, Tong Li, Ziqiang Wang, Yinchao Zhang, Rongbang Wu, Zhenxing Zhang, Jing Hu, Hanlin Huang, Xinle Du, Su Yao, Qi Li, Ke Xu

arXiv:2609.37672v1cs.NI

TL;DR

Encrypted traffic analysis needs reusable representations because labels are costly and shifting traffic requires repeated updates, while existing methods leave explicit behavioral grounding underexplored. NetLexicon quantizes contextual traffic windows into behavioral states and trains them with future prediction and statistical alignment. Across downstream tasks, it improves Macro-F1 and fine-tuning efficiency, while its discussion notes a granularity tradeoff that can merge fine-grained distinctions.

  • Problem

    Encrypted traffic analysis relies on costly labels despite evolving services and network environments, and explicit grounding of learned representations in observable behavior remains underexplored.

    Source: §1 · p. 1

  • Method

    NetLexicon quantizes contextual traffic windows into reusable discrete states and trains them with future-behavior prediction and alignment to window-level traffic statistics.

    Source: §1 · p. 2

  • Results

    Across downstream traffic classification tasks, NetLexicon improves Macro-F1 by up to 25.5 percentage points over strong baselines and reduces fine-tuning time per epoch by up to 23.6×.

    Source: §6 · p. 9

  • Takeaways & Limitations

    A compact traffic-state vocabulary can share recurring behavioral patterns across flows, with downstream supervision determining their relevance to a particular task.

    Source: §5 · p. 8

    Sharing codewords can merge distinctions that matter for fine-grained classification, so codebook capacity and assignment context determine which behavioral differences remain visible.

    Source: §5 · p. 8

Abstract

from arXiv · show

Encrypted Web traffic analysis requires effective representations of observable communication behavior. Existing pretraining methods often adapt NLP/CV objectives and sequence architectures, motivating learning objectives that capture traffic-specific interaction patterns. We present NetLexicon, a discrete pretraining framework that learns reusable behavioral states from unlabeled traffic. It converts contextual traffic windows into discrete states through vector quantization, constructing a compact traffic lexicon. We design two complementary pretraining objectives. State Transition Prediction (STP) forecasts subsequent sequence structure and packet features from observed history, while Statistical Feature Alignment (SFA) grounds learned states in window-level traffic statistics. Together, they guide the lexicon to capture recurring communication behaviors and their evolution. We evaluate NetLexicon on four benchmarks covering Web application identification, service type identification, and malware detection. NetLexicon improves Macro-F1 by up to 25.5 percentage points over the strongest baseline on each benchmark and reduces fine-tuning time per epoch by up to 23.6 times relative to the evaluated baselines. Further analysis shows that the learned discrete states capture recognizable patterns in packet size, timing, and data transfer. These results demonstrate that incorporating observable behavioral structure into pretraining supports effective, efficient, and interpretable representations for encrypted traffic analysis.

1 Introduction

Encrypted traffic analysis uses observable packet behavior for identification and security, but labeled data is costly and traffic shifts require repeated updates. NetLexicon learns discrete behavioral states from unlabeled traffic, combining future-behavior prediction with alignment to observable statistics.

1 Introduction

  • High-quality labels are expensive to obtain and maintain, while evolving services and network environments cause distribution shifts that require repeated model updates.Learning reusable representations from abundant unlabeled traffic is motivated as a way to reduce downstream labeling requirements and adaptation costs.Source: §1 · p. 1
  • Observable traffic semantics include data-transfer and interaction patterns, with packet lengths, inter-arrival times, direction changes, and bursts providing behavioral cues.Their combination and evolution within flow context provide a basis for learning traffic semantics.Source: §1 · p. 1
  • The paper frames the problem as learning reusable behavioral states that capture encrypted interaction patterns and their evolution over time.Its motivation connects temporal dependencies with recurring packet-length, direction, and timing patterns across flows.Source: §1 · p. 1
  • NetLexicon maps contextual packet and burst windows to a finite set of codewords through vector quantization, forming a lexicon whose state sequences describe communication evolution.Similar window-level behaviors share states.Source: §1 · p. 2
  • State Transition Prediction forecasts subsequent sequence structure and packet features, while Statistical Feature Alignment matches quantized states to packet-length, direction, and timing statistics.Together, these objectives guide the lexicon to capture recurring behaviors and their evolution.Source: §1 · p. 2
  • Evaluation covers website fingerprinting, encrypted application fingerprinting, service type identification, and malware detection, alongside interpretability and overhead analyses.The benchmarks are CSTNET, CipherSpectrum, ISCXVPN, and USTC-TFC, respectively.Source: §1 · p. 2
  • NetLexicon improves Macro-F1 by up to 25.5 percentage points, reduces fine-tuning time per epoch by up to 23.6×, and learns interpretable states aligned with meaningful communication behaviors.Source: §1 · p. 2

2 Background and Related Work

Prior traffic analysis developed statistical and learned representations, while self-supervised pretraining adapted sequence and contrastive objectives to traffic data. NetLexicon’s background frames discrete states as a way to organize recurring packet and interaction patterns and their evolution.

2.1 Traffic Representation Learning

  • Traffic classification uses statistical features with conventional classifiers and learned representations from CNNs, RNNs, and GNNs for tasks including website fingerprinting and encrypted stream identification.Packet size distributions, inter-arrival times, and flow statistics are among the features used under encryption and dynamic ports.Source: §2.1 · p. 2
  • Self-supervised traffic pretraining adapts masked prediction, reconstruction, sequence modeling, and other traffic organization strategies to unlabeled corpora and downstream classification.The cited approaches include ET-BERT, YaTC, NetMamba, TrafficFormer, Flow-MAE, and burst-based representations.Source: §2.1 · p. 2, §2.2 · p. 3
  • Prior work highlights dataset artifacts, spurious correlations, and shortcut learning, motivating objectives grounded in observable communication behavior.For NetLexicon, the stated behavioral basis includes packet size, direction, timing, and their temporal dependencies.Source: §2.1 · p. 2

2.2 Learning Discrete Traffic States

  • A traffic state is a learned behavioral category for a window; grouping similar windows into shared states compacts recurring patterns, while state sequences describe interaction evolution.NetLexicon quantizes contextual window representations into a discrete lexicon shaped by future-behavior prediction and alignment with window statistics.Source: §2.2 · pp. 2–3

3 NetLexicon

NetLexicon learns discrete behavioral states from flow-contextual packet and burst sequences. State Transition Prediction captures how communication evolves, while Statistical Feature Alignment grounds states in measurable traffic patterns.

3.1 Framework

  • Each packet is represented by seven normalized features and seven missing indicators, while a causal encoder summarizes traffic through each window.Features include packet size, direction, inter-arrival time, TCP flags, IPID delta, and relative TCP sequence and acknowledgement numbers.Source: §3.1 · p. 3

3.2 Discrete Traffic Lexicon

  • Contextual window representations are assigned to codebook entries, producing a sequence of reusable behavioral states for each flow.The codebook is updated with exponential moving averages, and a commitment loss keeps encoder outputs close to their assigned codewords.Source: §3.2 · p. 3

3.3 State Transition Prediction

  • STP uses causal next-position predictions to train window states to capture subsequent sequence structure and packet features.Targets are formed by shifting the input sequence by one position; the type and feature heads predict sequence progression and the characteristics of following packets.Source: §3.3 · p. 4

3.4 Statistical Feature Alignment

  • SFA aligns each quantized state with 37 statistics from its window, covering traffic volume, direction, packet lengths, timing, TCP flags, and active or idle behavior.Its contrastive objective matches a state view with statistics from the same window more closely than statistics from other windows.Source: §3.4 · pp. 4–5

3.5 Pretraining Objective and Adaptation

  • Pretraining combines temporal prediction, codebook commitment, and statistical alignment; downstream adaptation initializes the encoder and embedding, pools [WIN] states, and fine-tunes a task head on labeled flows.The shared encoder and prediction and projection heads are trained using supervision constructed from unlabeled traffic.Source: §3.5 · p. 5

4 Evaluation

Evaluation covers four downstream traffic tasks, examining classification performance, behavioral information in the lexicon, and computational cost.

4.1 Experimental Setup

  • Pretraining combines MAWI and VisQUIC; downstream data are split by flow at an 8:1:1 ratio, with partitions shared across methods.The corpus contains 1,057,331 flows and approximately 86.34 million packets. Macro-F1 is the primary classification metric; baselines use consistent downstream protocols where applicable.Source: §4.1 · pp. 5–6

4.2 Traffic Classification

  • NetLexicon leads all four tasks; Macro-F1 gains are 13.15 points on CSTNET, 3.88 on CipherSpectrum, and 25.49 on ISCXVPN.On CipherSpectrum, the advantage remains when application classes are balanced across cipher configurations.Source: Table 5 · p. 6, Table 4 · p. 6, §4.2 · p. 6
  • The full model achieves the highest Macro-F1 among ablation variants; removing pretraining causes the largest drops, while removing SFA reduces active codes.SFA removal changes active codes from 97 to 61 on CSTNET and from 124 to 118 on CipherSpectrum; codebook sizes from 32 to 512 yield 90.95%–91.16% accuracy.Source: §4.2 · pp. 6–7, Figure 5 · p. 7

4.3 Traffic Semantics Analysis

  • Representation distances correlate 0.4476 with packet size and 0.3537 with inter-arrival time, approximately 2.82× and 1.97× the strongest baselines.Code #4 profiles sparse exchanges, while Code #56 profiles sustained transfer; each state appears across multiple traffic sources.Source: Figure 6 · p. 7, §4.3 · p. 7, Figure 7 · p. 8

4.4 Efficiency and Overhead

  • NetLexicon has 1.9M parameters and takes 3.0 minutes per fine-tuning epoch, up to 23.6× less than evaluated baselines.At batch size 32, inference latency is 11.1 ms and GPU memory usage is 0.9 GB.Source: Figure 8 · p. 8, §4.4 · p. 8

5 Discussion

The discussion frames discrete states as reusable summaries of interaction patterns while noting granularity and deployment tradeoffs.

5 Discussion

  • Shared states can capture behaviors recurring across applications, with downstream supervision determining their relevance to a particular task.The lexicon is presented as a reusable summary of interaction patterns.Source: §5 · p. 8
  • Codeword sharing can consolidate similar interactions but may merge distinctions needed for fine-grained classification; codebook capacity and context jointly shape retained differences.Changes in network conditions or protocol implementations can alter observable packet sizes and timing, motivating adaptation of both encoder and codebook.Source: §5 · p. 8
  • Codebook lookup is inexpensive, but contextual window representations still require neural computation; smaller or hardware-compatible predictors remain future work.The proposed direction aims to address inference cost and behavioral fidelity together.Source: §5 · pp. 8–9

6 Conclusion

NetLexicon learns reusable behavioral states from traffic, with STP predicting future behavior and SFA grounding states in window statistics.

6 Conclusion

  • Across downstream traffic classification tasks, NetLexicon improves Macro-F1 by up to 25.5 percentage points, reduces fine-tuning time per epoch by up to 23.6×, and learns interpretable states.The conclusion presents discrete behavioral modeling as a promising approach to efficient and interpretable traffic analysis.Source: §6 · p. 9

A Feature Definitions

NetLexicon uses packet-level inputs and window-level statistical summaries for distinct roles: sequential modeling and STP use packet features, while SFA uses window statistics to anchor discrete states to traffic behavior.

Packet-level features

  • Seven packet-level features are normalized and combined with seven missing-value indicators to form each 14-dimensional packet input.The selected features cover packet size, direction, timing, TCP flags, IPID delta, and relative TCP sequence and acknowledgment numbers.Source: A Feature Definitions · p. 10

Normalization

  • Packet-size scaling, binary direction values, TCP-flag scaling, and logarithmic compression for heavy-tailed features precede standardization.Inter-arrival time uses log(1+x); relative sequence and acknowledgment numbers use log(1+max(0,x)); ΔIPID is directly z-score normalized.Source: A Feature Definitions · p. 10

Window-level statistical summaries

  • Basic traffic and packet-length summaries capture directional volume, packet counts, packet-size behavior, and distribution shape within each window.The packet-length group includes extrema and skewness as well as first- and second-order statistics.Source: A Feature Definitions · p. 11
  • Timing summaries capture flow-level and direction-specific pacing, while TCP control statistics describe setup, acknowledgment, reset, and teardown behavior.Source: A Feature Definitions · p. 11
  • Flow-behavior statistics summarize burstiness and active-versus-idle periods, complementing the other window summaries used by SFA to anchor discrete states.Source: A Feature Definitions · p. 11

B Implementation Details

Implementation preserves each baseline’s input format while using NetLexicon’s packet features and missing indicators; downstream training proceeds from a frozen-backbone head stage to joint fine-tuning.

Baseline inputs

  • ET-BERT and TrafficFormer use five packets of 64 bytes per flow, YaTC and NetMamba use 40 × 40 images, and Pcap-Encoder uses individual packets as samples.Source: B Implementation Details · p. 11

NetLexicon inputs

  • NetLexicon represents packets with seven normalized features and seven missing indicators, and masks padding from attention and pretraining losses.It uses separate token-type and position embeddings, with STP and SFA heads during pretraining.Source: B Implementation Details · p. 11

Downstream training

  • Downstream training first fits a classification head with the backbone frozen, then jointly fine-tunes the model.The head-only stage uses ten times the base learning rate; all windows from a flow inherit its dataset split.Source: B Implementation Details · p. 12

C Additional Codebook Entries

The fine-tuned CipherSpectrum codebook contains recurring, behaviorally recognizable traffic-window states, with table entries pairing activation counts and traffic profiles with application labels and heuristic tags.

Recurring patterns

Behavioral interpretation

  • Each entry’s assignment count indicates state reuse, while its traffic statistics and heuristic tag describe the associated communication behavior.Source: C Additional Codebook Entries · p. 12

Codebook entries

Related papers

Loading 2609.37672v1…