一种基于多特征融合的加密流量分类方法

doi:10.3969/j.issn.1671-1122.2026.05.007

信息网络安全 ›› 2026, Vol. 26 ›› Issue (5): 747-757.doi: 10.3969/j.issn.1671-1122.2026.05.007

一种基于多特征融合的加密流量分类方法

苏兆品¹^,²^,³, 方宏程¹, 张国富¹^,³^,⁴(), 王垚飞¹^,²^,³

¹ 合肥工业大学计算机与信息学院, 合肥 230601
² 智能互联系统安徽省实验室, 合肥 230009
³ 工业安全与应急技术安徽省重点实验室, 合肥 230601
⁴ 音视频智能防识联合实验室, 合肥 230009

收稿日期:2025-11-25 出版日期:2026-05-10 发布日期:2026-06-03
通讯作者: 张国富 zgf@hfut.edu.cn
作者简介:苏兆品（1983—）,女,山东,副教授,博士,主要研究方向为复杂智能系统、多媒体安全|方宏程（2001—）,男,安徽,硕士研究生,主要研究方向为加密流量分类|张国富（1979—）,男,安徽,教授,博士,主要研究方向为语音安全|王垚飞（1996—）,男,河北,副教授,博士,主要研究方向为多媒体内容安全
基金资助:
国家自然科学基金(62302146)

A Multi-Feature Fusion Based Encrypted Traffic Classification Method

SU Zhaopin¹^,²^,³, FANG Hongcheng¹, ZHANG Guofu¹^,³^,⁴(), WANG Yaofei¹^,²^,³

¹ School of Computer and Information Technology, Hefei University of Technology, Hefei 230601, China
² Intelligent Interconnected System Anhui Laboratory, Hefei 230009, China
³ Anhui Province Key Laboratory of Industry Safety and Emergency Technology, Hefei 230601, China
⁴ Joint Laboratory of Intelligent Prevention and Recognition of Audio and Video, Hefei 230009, China

Received:2025-11-25 Online:2026-05-10 Published:2026-06-03

摘要/Abstract

摘要：

随着加密通信的广泛应用,流量分类面临新的挑战。传统方法在处理加密流量时效果不佳,现有方法要么依赖手工特征提取,要么无法充分捕捉数据包间的交互模式。为此,文章提出一种基于多特征融合的加密流量分类（MFF-ETC）方法。在预处理阶段,该方法将数据包的有效载荷生成的包级图像组合成会话图像,有效减轻信息混淆并保留数据包间的交互模式。在分类阶段,会话图像分别经过包视觉转换器（PVT）、时间流量卷积网络（T-TCN）和流量门控瓶颈卷积（T-GBConv）模块处理,提取全局特征、全尺度时间特征和空间特征。随后,通过动态加权机制融合3类特征,根据流量类型动态调整权重,实现更准确的分类。实验结果表明,MFF-ETC在ISCX-VPN-Service、ISCX-VPN-App和CSTNET-TLS1.3上的F1分数分别达到98.81%、98.93%和98.05%,验证了该方法的高分类精度与泛化能力。

关键词: 加密流量分类, 全局特征, 时间特征, 空间特征, 动态加权机制融合

Abstract:

With the widespread adoption of encrypted communications, traffic classification faces new challenges. Traditional methods perform poorly when dealing with encrypted traffic, as existing approaches either rely on manual feature extraction or fail to fully capture the interaction patterns between packets. To address this issue, this paper proposed a Multi-feature Fusion based Encrypted Traffic classification method (MFF-ETC). In the preprocessing stage, the method combined packet-level images generated from packet payloads into session images, effectively mitigating information confusion while preserving the interaction patterns among packets. In the classification stage, the session images were processed by three modules: the Packet Vision Transformer (PVT), the Temporal Traffic Convolutional Network (T-TCN), and the Traffic Gated Bottleneck Convolution (T-GBConv) module, which extracted global features, full-scale temporal features, and spatial features, respectively. Subsequently, a dynamic weighting mechanism fused these three types of features, adjusting their weights adaptively according to the traffic type to achieve more accurate classification. Experimental results demonstrate that MFF-ETC achieves F1-score of 98.81%, 98.93%, and 98.05% on the ISCX-VPN-Service, ISCX-VPN-App, and CSTNET-TLS1.3 datasets, respectively, validating the method’s high classification accuracy and generalization capability.

Key words: encrypted traffic classification, global features, temporal features, spatial features, dynamic weighted feature fusion

中图分类号:

TP309

苏兆品, 方宏程, 张国富, 王垚飞. 一种基于多特征融合的加密流量分类方法[J]. 信息网络安全, 2026, 26(5): 747-757.

SU Zhaopin, FANG Hongcheng, ZHANG Guofu, WANG Yaofei. A Multi-Feature Fusion Based Encrypted Traffic Classification Method[J]. Netinfo Security, 2026, 26(5): 747-757.

图/表 11

图1

图2

图3

图4

图5

表1

图6

图7

图8

图9

表2

参考文献 35

[1]	VELAN P, CERMAK M, CELEDA P, et al. A Survey of Methods for Encrypted Traffic Classification and Analysis[J]. International Journal of Network Management, 2015, 25(5): 355-374. doi: 10.1002/nem.v25.5 URL
[2]	LIN Xinjie, XIONG Gang, GOU Gaopeng, et al. Et-bert: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification[C]//ACM. The ACM Web Conference 2022 (WWW’22). New York: ACM, 2022: 633-642.
[3]	LIU Rui, YU Xiangzhan. A Survey on Encrypted Traffic Identification[C]// ACM. International Conference on Cyberspace Innovation of Advanced Technologies (CIAT 2020). New York: ACM, 2020: 159-163.
[4]	ELMAGHRABY R T, AZIEM N M A, SOBH M A, et al. Encrypted Network Traffic Classification Based on Machine Learning[J]. Ain Shams Engineering Journal, 2024, 15(2): 1-10.
[5]	OKONKWO Z, FOO E, LI Qinyi, et al. A CNN Based Encrypted Network Traffic Classifier[C]//ACM. the 2022 Australasian Computer Science Week (ACSW 2022). New York: ACM, 2022: 74-83.
[6]	REZAEI S, LIU Xin. Deep Learning for Encrypted Traffic Classification: An overview[J]. IEEE Communications Magazine, 2019, 57(5): 76-81. doi: 10.1109/MCOM.2019.1800819
[7]	LAN Jinghong, LIU Xudong, LI Bo, et al. DarknetSec: A Novel Self-attentive Deep Learning Method for Darknet Traffic Classification and Application Identification[J]. Computers & Security, 2022, 116(2): 1-16.
[8]	AZAB A, KHASAWNEH M, ALRABAEE S, et al. Network Traffic Classification: Techniques, Datasets, and Challenges[J]. Digital Communications and Networks, 2024, 10(3): 676-692. doi: 10.1016/j.dcan.2022.09.009
[9]	TAYLOR V F, SPOLAOR R, CONTI M, et al. Robust Smartphone App Identification via Encrypted Network Traffic Analysis[J]. IEEE Transactions on Information Forensics and Security, 2017, 13(1): 63-78. doi: 10.1109/TIFS.2017.2737970 URL
[10]	AL-NAAMI K, CHANDRA S, MUSTAFA A, et al. Adaptive Encrypted Traffic Fingerprinting with Bi-directional Dependence[C]//ACM. The 32nd Annual Conference on Computer Security Applications. New York: ACM, 2016: 177-188.
[11]	LIU Chang, HE Longtao, XIONG Gang, et al. Fs-Net: A Flow Sequence Network for Encrypted Traffic Classification[C]//IEEE. IEEE INFOCOM 2019-IEEE Conference on Computer Communications. New York: IEEE, 2019: 1171-1179.
[12]	SHAPIRA T, SHAVITT Y. FlowPic: A Generic Representation for Encrypted Traffic Classification and Applications Identification[J]. IEEE Transactions on Network and Service Management, 2021, 18(2): 1218-1232. doi: 10.1109/TNSM.2021.3071441 URL
[13]	WANG Wei, ZHU Ming, WANG Jinlin, et al. End-to-End Encrypted Traffic Classification with One-dimensional Convolution Neural Networks[C]//IEEE. International Conference on Intelligence and Security Informatics. New York: IEEE, 2017: 43-48.
[14]	WANG Wei, ZHU Ming, ZENG Xuewen, et al. Malware Traffic Classification using Convolutional Neural Network for Representation Learning[C]//IEEE. International Conference on Information Networking. New York: IEEE, 2017: 712-717.
[15]	SHEN Meng, ZHANG Jinpeng, ZHU Liehuang, et al. Accurate Decentralized Application Identification via Encrypted Traffic Analysis using Graph Neural Networks[J]. IEEE Transactions on Information Forensics and Security, 2021, 16: 2367-2380. doi: 10.1109/TIFS.10206 URL
[16]	HUOH T L, LUO Yan, LI Peilong, et al. Flow-Based Encrypted Network Traffic Classification with Graph Neural Networks[J]. IEEE Transactions on Network and Service Management, 2022, 20(2): 1224-1237. doi: 10.1109/TNSM.2022.3227500 URL
[17]	ZHANG Haozhen, YUE Haodong, XIAO Xi, et al. Revolutionizing Encrypted Traffic Classification with MH-Net: A Multi-View Heterogeneous Graph Model[C]//AAAI. The AAAI Conference on Artificial Intelligence. Menlo park: AAAI, 2025: 1048-1056.
[18]	WANG Zhanyi. The Applications of Deep Learning on Traffic Identification[J]. BlackHat USA, 2015, 24(11): 1-10.
[19]	LOTFOLLAHI M, SIAVOSHANI M J, ZADE R S H, et al. Deep Packet: A novel Approach for Encrypted Traffic Classification using Deep Learning[J]. Soft Computing, 2020, 24(3): 1999-2012. doi: 10.1007/s00500-019-04030-2
[20]	LIU Ya, WANG Xiao, QU Bo, et al. ATVITSC: A novel Encrypted Traffic Classification Method based on Deep Learning[J]. IEEE Transactions on Information Forensics and Security, 2024, 19(4): 9374-9389. doi: 10.1109/TIFS.2024.3433446 URL
[21]	ZHU Peng, WANG Gang, HE Jingheng, et al. An Encrypted Traffic Identification Method Based on Multi-Scale Feature Fusion[J]. Array, 2024, 21: 1-10.
[22]	WANG Guanyu, GU Yijun. Multi-Task Scenario Encrypted Traffic Classification and Parameter Analysis[J]. Sensors, 2024, 24(10): 1-21. doi: 10.3390/s24010001 URL
[23]	CHEN Zhenwei, WEI Xiaoxu, WANG Yongsheng. Encrypted Traffic Classification Encoder based on Lightweight Graph Representation[J]. Scientific Reports, 2025, 15(1): 1-14. doi: 10.1038/s41598-024-84936-6
[24]	HE Yanjie, LI Wei. Image-Based Encrypted Traffic Classification with Convolution Neural Networks[C]//IEEE. 2020 IEEE Fifth International Conference on Data Science in Cyberspace. New York: IEEE, 2020: 271-278.
[25]	YANG Wen, TANG Chenxi, TANG Chaowei, et al. Traffic through Two Lenses: A Dual-branch Vision Transformer for IoT Traffic Classification[J]. Computer Networks, 2025, 269: 1-13.
[26]	CHEN Xuyang, HAN Lu, ZHAN Dechuan, et al. MIETT: Multi-Instance Encrypted Traffic Transformer for Encrypted Traffic Classification[C]//AAAI. The AAAI Conference on Artificial Intelligence. Menlo park: AAAI, 2025: 15922-15929.
[27]	ZHANG Jianwei, ZHAO Hongying, FENG Yuan, et al. NetST: Network Encrypted Traffic Classification Based on Swin Transformer[J]. Computers, Materials & Continua, 2025, 84(3): 5279-5298.
[28]	JIN Yanliang, CHEN Yantao, GAO Yuan, et al. Encrypted Traffic Classification Based on Attention Temporal Convolutional Network[J]. Journal of Applied Sciences, 2024, 42(4): 659-672.
	金彦亮, 陈彦韬, 高塬, 等. 基于注意力时间卷积网络的加密流量分类[J]. 应用科学学报, 2024, 42(4): 659-672.
[29]	LUO Donghao, WANG Xue. Moderntcn: A Modern Pure Convolution Structure for General Time Series Analysis[C]//ICLR. The 12th International Conference on Learning Representations. New York: ICLR, 2024: 1-43.
[30]	WAN Renzhuo, MEI Shuping, WANG Jun, et al. Multivariate Temporal Convolutional Network: A Deep Neural Networks Approach for Multivariate Time Series Forecasting[J]. Electronics, 2019, 8(8): 1-18. doi: 10.3390/electronics8010001 URL
[31]	LIN Xudong, MA Lin, LIU Wei, et al. Context-Gated Convolution[C]//Springer. European Conference on Computer Vision. Heidelberg: Springer, 2020: 701-718.
[32]	LI Fanrong, LI Gang, HE Xiangyu, et al. Dynamic Dual Gating Neural Networks[C]//IEEE. The IEEE/CVF International Conference on Computer Vision. New York: IEEE, 2021: 5330-5339.
[33]	HUANG Hong, ZHOU Yinghang, JIANG Feng, et al. MFF: A Multimodal Feature Fusion Approach for Encrypted Traffic Classification[J]. Electronics, 2025, 14(13): 1-26. doi: 10.3390/electronics14010001 URL
[34]	DRAPER-GIL G, LASHKARI A H, MAMUN M S I, et al. Characterization of Encrypted and Vpn Traffic using Time-related[C]//Springer. The 2nd International Conference on Information Systems Security and Privacy. Heidelberg: Springer, 2016: 407-414.
[35]	SATTAR S, KHAN S, KHAN M I, et al. Anomaly Detection in Encrypted Network Traffic using Self-supervised Learning[J]. Scientific Reports, 2025, 15(1): 1-21. doi: 10.1038/s41598-024-84936-6

超参数	值	超参数	值
包数	16包	字节	256
训练集分配	70%	验证集分配	10%
测试集分配	20%	批量大小	16
学习率	$5\times {{10}^{-4}}$	纪元数	30
优化器	Adam	损失函数	Cross Entropy
PVT深度	2	多头注意机制数	12
注意残差层数	2层	前馈神经网络隐层大小	2048
全局特征维度	256	深度学习框架	Pytorch1.12.0
GPU	RTX 4060	CUDA版本	11.6

模型	AC	PR	RC	F1
PVT	95.70%	95.51%	94.50%	94.87%
T-TCN	92.23%	91.70%	91.72%	91.70%
T-GBConv	89.60%	89.40%	89.55%	89.51%
PVT+ T-TCN	96.78%	96.21%	95.86%	96.15%
PVT+ T-TCN + T-GBConv	97.20%	96.83%	96.12%	97.06%
PVT+ T-TCN + T-GBConv +MFFC	98.03%	97.92%	97.95%	98.01%

一种基于多特征融合的加密流量分类方法

A Multi-Feature Fusion Based Encrypted Traffic Classification Method

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 11

参考文献 35

相关文章 2

编辑推荐

Metrics

本文评价

[1]	韩益亮, 彭一轩, 吴旭光, 李鱼. 基于图变分自编码器的多模态特征融合加密流量分类模型[J]. 信息网络安全, 2025, 25(12): 1914-1926.
[2]	邰滢滢, 魏苑苑, 周翰逊, 王妍. 基于最优传输与改进型极限学习机的加密流量分类方法[J]. 信息网络安全, 2025, 25(1): 148-158.