用树形结构分析加密流量,让模型更懂协议语义。
Treat Traffic Like Trees: A Semantic-Preserving Hierarchical Graph-Based Expert Framework for Encrypted Traffic Analysis

- 构建字段级图结构,模拟协议层的层级关系
- 在无数据泄露条件下超越现有最佳模型
- 可解释性强,揭示模型决策依据
基于图的深度学习方法已被广泛用于加密流量分析,以挖掘不同粒度间的潜在关联。然而,复杂的预处理流程和精巧的模型结构虽能取得优异性能,却可能在表示学习过程中遮蔽了协议本身的语义。此外,协议层及其字段的层级结构(由协议规范定义,常用于人工分析)在现有学习框架中仍被忽视。本文提出协议树图注意力混合专家模型(PTGAMoE),一种保留语义的分层图专家框架,用于加密流量分析。基于字段的图构建与专家委员会设计,使PTGAMoE能够量化模型对特定字段和协议的偏好。在代表性基准数据集上,于严格的无数据泄露条件下进行的大量实验表明,PTGAMoE显著优于当前最优模型。此外,其保留语义的设计提供了协议级特征重要性和专家级贡献的可解释洞察,反映了模型在加密流量分类任务中的决策逻辑。
原文摘要 · Abstract (English)
Graph-based deep learning methods have been widely employed in encrypted traffic analysis to exploit latent correlations across different granularities. However, while complex preprocessing pipelines and sophisticated model structures often achieve strong performance, they may obscure inherent protocol semantics during representation learning. Moreover, the hierarchical structure of protocol layers and their corresponding fields, defined by protocol specifications and routinely utilized in manual traffic analysis, remains underexplored in existing learning frameworks. In this paper, we propose Protocol Tree Graph Attention with Mixture of Experts (PTGAMoE), a semantic-preserving hierarchical graph-based expert framework for encrypted traffic analysis. The field-based graph construction and expert committee design enable PTGAMoE to quantify the model's preferences for specific fields and protocols. Extensive experimental results on representative benchmark datasets under strict no-data-leakage settings demonstrate that PTGAMoE significantly outperforms state-of-the-art (SOTA) models. Furthermore, the semantic-preserving design provides interpretable insights into protocol-level feature importance and expert-level contributions, reflecting the model's decision-making logic in encrypted traffic classification tasks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。