DVG-GNN: Dual-View Graph Representation Learning for Encrypted Traffic Classification

The rapid proliferation of encrypted communication technologies, such as TLS, VPNs, and Tor, has significantly limited the effectiveness of traditional traffic classification methods that rely on port numbers or deep packet inspection. While handcrafted statistical features provide partial solutions, they often lack robustness and generalization in complex traffic scenarios. Although deep learning models such as CNNs and RNNs can capture local and sequential patterns, they typically overlook higher-order structural dependencies among bytes. To address these challenges, we propose DVG-GNN, a Dual-View Graph representation learning framework for encrypted traffic classification. The framework decomposes each packet into header and payload views, leveraging distinct byte embeddings and multi-scale one-dimensional convolutions to extract fine-grained contextual features. View-specific graphs are constructed using Pointwise Mutual Information (PMI) to model byte-level relationships, and a GraphSAGE-based encoder with attention pooling is employed to learn global structural representations. A gated fusion mechanism further integrates the dual-view features to enhance discriminative capability. Extensive experiments on ISCX-VPN2016, ISCX-Tor2016, and USTC-TFC2016 demonstrate that the proposed method consistently outperforms state-of-the-art approaches across multiple evaluation metrics, validating its effectiveness and generalization ability in diverse encrypted traffic classification tasks.