Abstract:

With the widespread adoption of encrypted communications, traffic classification faces new challenges. Traditional methods perform poorly when dealing with encrypted traffic, as existing approaches either rely on manual feature extraction or fail to fully capture the interaction patterns between packets. To address this issue, this paper proposed a Multi-feature Fusion based Encrypted Traffic classification method (MFF-ETC). In the preprocessing stage, the method combined packet-level images generated from packet payloads into session images, effectively mitigating information confusion while preserving the interaction patterns among packets. In the classification stage, the session images were processed by three modules: the Packet Vision Transformer (PVT), the Temporal Traffic Convolutional Network (T-TCN), and the Traffic Gated Bottleneck Convolution (T-GBConv) module, which extracted global features, full-scale temporal features, and spatial features, respectively. Subsequently, a dynamic weighting mechanism fused these three types of features, adjusting their weights adaptively according to the traffic type to achieve more accurate classification. Experimental results demonstrate that MFF-ETC achieves F1-score of 98.81%, 98.93%, and 98.05% on the ISCX-VPN-Service, ISCX-VPN-App, and CSTNET-TLS1.3 datasets, respectively, validating the method’s high classification accuracy and generalization capability.

Key words: encrypted traffic classification, global features, temporal features, spatial features, dynamic weighted feature fusion