用协议结构做压缩,让加密流量分类更轻量高效
Pruned Traffic Trees: Native Semantic Compression with a Protocol-Structured Model Family for Encrypted Traffic Classification

- 以协议树为单位进行结构化压缩,保留关键字段和上下文
- 轻量版模型参数减少61%,推理速度提升8.7倍,性能仍超91%
- 适合资源受限的路由器、防火墙等网络设备部署
深度学习在加密流量分类(ETC)中表现优异,但计算开销限制了其在路由器、中间盒等资源受限设备上的部署。现有压缩方法多针对权重、通道或隐藏表示,未明确哪些协议字段与结构上下文应保留。本文提出剪枝流量树(PTT),一种三级协议结构化模型族,将原始协议结构作为压缩单元。PTT-Full通过流级自监督学习和协议存在感知稀疏执行,从完整协议树图(PTGs)中学习协议结构表示与字段重要性;基于学习到的重要性及TopK+$k$闭包生成蒸馏协议树图(PTG-Ds),用于PTT-Distilled;PTT-Lite则通过结构对齐迁移与流级逻辑蒸馏降低宽度。在流不重叠和强信息掩码(SII)设置下,PTT-Full在CSTNET-TLS1.3和CipherSpectrum上分别达到0.9519和0.9416的宏平均F1分数,而PTT-Lite仅需80.3%和61.3%的参数,有效浮点运算降低98.85%和98.78%,CPU推理速度提升8.75×和8.46×,同时保持0.9325和0.9136的高性能。结果表明,将协议结构本身作为压缩对象,可实现轻量级ETC的有效性能-效率权衡。
原文摘要 · Abstract (English)
Deep learning has achieved strong performance in encrypted traffic classification (ETC), yet its computational cost limits deployment on resource-constrained network devices such as routers and middleboxes. Existing compression methods mainly operate on weights, channels, hidden representations, or predictions, but do not explicitly determine which protocol fields and structural contexts should remain. We propose Pruned Traffic Trees (PTT), a three-level protocol-structured model family that treats native protocol structures as compression units. PTT-Full learns protocol-structured representations and field salience from complete Protocol Tree Graphs (PTGs), with flow-level self-supervised learning and protocol-presence-aware sparse execution. The learned salience and TopK+$k$ closure construct Distilled PTGs (PTG-Ds) for PTT-Distilled, while PTT-Lite inherits this topology and reduces width through structure-aligned transfer and flow-level logits distillation. Under flow-disjoint and Strong Information Information (SII)-masked settings, PTT-Full achieves Macro-F1 scores of 0.9519 and 0.9416 on CSTNET-TLS1.3 and CipherSpectrum, while PTT-Lite retains 0.9325 and 0.9136 with 80.3\% and 61.3\% fewer parameters, 98.85\% and 98.78\% lower effective GFLOPs, and 8.75$\times$ and 8.46$\times$ CPU inference speedups. These results demonstrate that treating protocol structure itself as the compression object enables effective performance-efficiency trade-offs for lightweight ETC.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。