针对加密流量分类中特征混淆问题,提出动态分治的专家混合框架。
TrafficMoE: Heterogeneity-aware Mixture of Experts for Encrypted Traffic Classification
- 采用双分支稀疏专家混合模型,分离解析报头与密文载荷
- 引入不确定性过滤机制,抑制高方差噪声干扰
- 基于上下文动态路由聚合特征,提升分类精度
加密流量分类是网络安全部署的关键任务。尽管深度学习已推动该领域发展,但加密对载荷语义的屏蔽严重挑战了传统建模方法。现有框架多依赖静态、同质化处理流程,在所有输入上采用统一参数共享和固定融合策略。这种‘一刀切’设计将结构化报头与随机化载荷强行纳入同一处理路径,不可避免地使原始协议信号与加密噪声混杂,导致细粒度判别特征退化。本文提出 TrafficMoE 框架,打破静态建模瓶颈,构建解耦-过滤-聚合(DFA)范式。具体而言,通过双分支稀疏 Mixture-of-Experts(MoE)实现报头与载荷的解耦,支持模态专属建模;设计不确定性感知过滤机制,量化表示可靠性并选择性抑制高方差特征;提出路由引导的动态聚合策略,依据流量上下文自适应加权跨模态特征。该 DFA 范式使模型仅聚焦最具判别性的流量特征,显著提升表征效率。在六个数据集上的大量实验表明,TrafficMoE 持续优于当前最优方法,验证了异构感知建模在加密流量分析中的必要性。源码已公开于 https://github.com/Posuly/TrafficMoE_main。
原文摘要 · Abstract (English)
Encrypted traffic classification is a critical task for network security. While deep learning has advanced this field, the occlusion of payload semantics by encryption severely challenges standard modeling approaches. Most existing frameworks rely on static and homogeneous pipelines that apply uniform parameter sharing and static fusion strategies across all inputs. This one-size-fits-all static design is inherently flawed: by forcing structured headers and randomized payloads into a unified processing pipeline, it inevitably entangles the raw protocol signals with stochastic encryption noise, thereby degrading the fine-grained discriminative features. In this paper, we propose TrafficMoE, a framework that breaks through the bottleneck of static modeling by establishing a Disentangle-Filter-Aggregate (DFA) paradigm. Specifically, to resolve the structural between-components conflict, the architecture disentangles headers and payloads using dual-branch sparse Mixture-of-Experts (MoE), enabling modality-specific modeling. To mitigate the impact of stochastic noise, an uncertainty-aware filtering mechanism is introduced to quantify reliability and selectively suppress high-variance representations. Finally, to overcome the limitations of static fusion, a routing-guided strategy aggregates cross-modality features dynamically, that adaptively weighs contributions based on traffic context. With this DFA paradigm, TrafficMoE maximizes representational efficiency by focusing solely on the most discriminative traffic features. Extensive experiments on six datasets demonstrate TrafficMoE consistently outperforms state-of-the-art methods, validating the necessity of heterogeneity-aware modeling in encrypted traffic analysis. The source code is publicly available at https://github.com/Posuly/TrafficMoE_main.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。