Enhancing Fine-Grained Encrypted Traffic Classification via Temporal Bi-Directional GraphSAGE
Source abstract
Abstract
Encrypted traffic classification is essential for network management and security, yet payload inspection is ineffective under modern protocols such as Transport Layer Security (TLS) and Quick UDP Internet Connections (QUIC). Existing metadata-based methods perform well for coarse-grained tasks but often fail to distinguish structurally similar applications because they model temporal behavior only implicitly or coarsely. We propose the Bi-Directional Directed Temporal Graph (BiDT), a framework based on a Directed Temporal Interaction Graph (DTIG) and a Bi-Directional GraphSAGE (BiGraphSAGE). The DTIG represents packets as nodes and explicitly encodes inter-arrival times (IATs) as directed edge attributes, preserving both causal structure and communication rhythm. The BiGraphSAGE then aggregates temporal interaction features from forward and backward perspectives. We evaluated the BiDT on the VNAT benchmark and validated it on ISCX-VPN. On the challenging 10-class VNAT dataset, the BiDT achieves 98.57% accuracy and outperforms strong baselines, including complete separation of easily confused protocols such as SCP and SFTP. The results on ISCX-VPN further confirm the effectiveness of the proposed design. These findings show that explicit temporal edge modeling is effective for fine-grained encrypted traffic classification.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Internet Traffic Analysis and Secure E-voting · Network Security and Intrusion Detection · Network Packet Processing and Optimization
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing 101408, China
Department of Cyber Security, Shanxi Police College, Taiyuan 030401, China
Intelligence Research Center, Shanxi Police College, Taiyuan 030401, China
School of Computer Science and Engineering, Hunan University of Science and Technology, Xiangtan 411201, China
References (43)
Show source-provided references
1. Liu, C., He, L., Xiong, G., Cao, Z., and Li, Z. (2019). Fs-net: A flow sequence network for encrypted traffic classification. Proceedings of the IEEE INFOCOM 2019—IEEE Conference On Computer Communications, IEEE.10.1109/INFOCOM.2019.8737507 ↗
2. Van Ede, T., Bortolameotti, R., Continella, A., Ren, J., Dubois, D.J., Lindorfer, M., Choffnes, D., Van Steen, M., and Peter, A. (2020, January 23–26). Flowprint: Semi-supervised mobile-app fingerprinting on encrypted network traffic. Proceedings of the Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA.10.14722/ndss.2020.24412 ↗
3. Durumeric, Z., Ma, Z., Springall, D., Barnes, R., Sullivan, N., Bursztein, E., Bailey, M.D., Halderman, J.A., and Paxson, V. (March, January 26). The Security Impact of HTTPS Interception. Proceedings of the NDSS Symposium, San Diego, CA, USA.
4. Anderson, B., and McGrew, D. (2016). Identifying encrypted malware traffic with contextual flow data. Proceedings of the 2016 ACM Workshop on Artificial Intelligence and Security, ACM.10.1145/2996758.2996768 ↗
5. Accurate decentralized application identification via encrypted traffic analysis using graph neural networks10.1109/TIFS.2021.3050608 ↗
6. Rezaei, S., and Liu, X. (2018). How to achieve high classification accuracy with just a few labels: A semi-supervised approach using sampled packets. arXiv.
7. Robust detection of malicious encrypted traffic via contrastive learning10.1109/TIFS.2025.3560560 ↗
8. ProGraph: Robust network traffic identification with graph propagation10.1109/TNET.2022.3216603 ↗
9. Interaction matters: Encrypted traffic classification via status-based interactive behavior graph10.1016/j.asoc.2024.111423 ↗
10. Pham, T.D., Ho, T.L., Truong-Huu, T., Cao, T.D., and Truong, H.L. (2021). Mappgraph: Mobile-app classification on encrypted network traffic using deep graph convolution neural networks. Proceedings of the 37th Annual Computer Security Applications Conference, ACM.10.1145/3485832.3485925 ↗
11. Taylor, V.F., Spolaor, R., Conti, M., and Martinovic, I. (2016). Appscanner: Automatic fingerprinting of smartphone apps from encrypted network traffic. Proceedings of the 2016 IEEE European Symposium on Security and Privacy (EuroS&P), IEEE.10.1109/EuroSP.2016.40 ↗
12. Novo, C., and Morla, R. (2020). Flow-based detection and proxy-based evasion of encrypted malware C2 traffic. Proceedings of the 13th ACM Workshop on Artificial Intelligence and Security, ACM.10.1145/3411508.3421379 ↗
13. Diao, Z., Qiao, M., Wang, X., Zhang, G., Liang, W., Chen, J., Pei, C., Li, Y., Li, Z., and Xie, G. (2026). Not All Data are What You Need: A Data-Efficient Training Method Using Heterogeneous Hardware. IEEE Trans. Knowl. Data Eng., 1–14.10.1109/TKDE.2026.3668991 ↗
14. Lin, X., Xiong, G., Gou, G., Li, Z., Shi, J., and Yu, J. (2022). Et-bert: A contextualized datagram representation with pre-training transformers for encrypted traffic classification. Proceedings of the ACM Web Conference 2022, ACM.10.1145/3485447.3512217 ↗
15. FlowPic: A generic representation for encrypted traffic classification and applications identification10.1109/TNSM.2021.3071441 ↗
16. FedETC: Encrypted traffic classification based on federated learning10.1016/j.heliyon.2024.e35962 ↗
17. FedAHPIP: Federated Learning with Adaptive Hot Parameter Identification and Personalized Anchoring for multi-agent collaboration
18. Graph neural networks: A review of methods and applications10.1016/j.aiopen.2021.01.001 ↗
19. A comprehensive survey on graph neural networks10.1109/TNNLS.2020.2978386 ↗
20. Threatrace: Detecting and tracing host-based threats in node level through provenance graph learning10.1109/TIFS.2022.3208815 ↗
21. He, H.Y., Yang, Z.G., and Chen, X.N. (2020). PERT: Payload encoding representation from transformer for encrypted traffic classification. Proceedings of the 2020 ITU Kaleidoscope: Industry-Driven Digital Transformation (ITU K), IEEE.10.23919/ITUK50268.2020.9303204 ↗
22. LUCID: A practical, lightweight deep learning solution for DDoS attack detection10.1109/TNSM.2020.2971776 ↗
23. A survey of payload-based traffic classification approaches10.1109/SURV.2013.100613.00161 ↗
24. Deep packet: A novel approach for encrypted traffic classification using deep learning10.1007/s00500-019-04030-2 ↗
25. Website fingerprinting at internet scale
26. Seeing traffic paths: Encrypted traffic classification with path signature features10.1109/TIFS.2022.3179955 ↗
27. Wang, W., Zhu, M., Wang, J., Zeng, X., and Yang, Z. (2017). End-to-end encrypted traffic classification with one-dimensional convolution neural networks. Proceedings of the 2017 IEEE International Conference on Intelligence and Security Informatics (ISI), IEEE.10.1109/ISI.2017.8004872 ↗
28. Sirinam, P., Imani, M., Juarez, M., and Wright, M. (2018). Deep fingerprinting: Undermining website fingerprinting defenses with deep learning. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, ACM.10.1145/3243734.3243768 ↗
29. A novel self-supervised framework based on masked autoencoder for traffic classification10.1109/TNET.2023.3335253 ↗
30. MFSI: Multi-flow based service identification for encrypted network traffic10.1016/j.comnet.2025.111283 ↗
31. Revolutionizing encrypted traffic classification with mh-net: A multi-view heterogeneous graph model10.1609/aaai.v39i1.32091 ↗
32. Zhang, H., Yu, L., Xiao, X., Li, Q., Mercaldo, F., Luo, X., and Liu, Q. (2023). Tfe-gnn: A temporal fusion encoder using graph neural networks for fine-grained encrypted traffic classification. Proceedings of the ACM Web Conference 2023, ACM.10.1145/3543507.3583227 ↗
33. A Unified Framework for Robust Encrypted Malicious Traffic Detection in Adverse Environments via Graph Structure Learning10.1109/TNSE.2025.3582871 ↗
34. Flow-based encrypted network traffic classification with graph neural networks10.1109/TNSM.2022.3227500 ↗
35. DE-GNN: Dual embedding with graph neural network for fine-grained encrypted traffic classification10.1016/j.comnet.2024.110372 ↗
36. Machine learning-powered encrypted network traffic analysis: A comprehensive survey10.1109/COMST.2022.3208196 ↗
37. Extensible machine learning for encrypted network traffic application labeling via uncertainty quantification10.1109/TAI.2023.3244168 ↗
38. Gil, G.D., Lashkari, A.H., Mamun, M., and Ghorbani, A.A. (2016). Characterization of encrypted and VPN traffic using time-related features. Proceedings of the 2nd International Conference on Information Systems Security and Privacy (ICISSP 2016), SciTePress.
39. NFStream: A flexible network data analysis framework10.1016/j.comnet.2021.108719 ↗
40. Biondi, P., Lalet, P., Potter, G., Valadon, G., and Weiss, N. (2026, March 02). Scapy: The Python-Based Interactive Packet Manipulation Program & Library. Available online: https://github.com/secdev/scapy.
41. GRAIN: Granular multi-label encrypted traffic classification using classifier chain10.1016/j.comnet.2022.109084 ↗
42. Zhang, H., Chen, Z., Xia, W., Xiong, G., Gou, G., Li, Z., Huang, G., and Li, Y. (2025). ANASETC: Automatic Neural Architecture Search for Encrypted Traffic Classification. Proceedings of the ICASSP 2025—2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), IEEE.10.1109/ICASSP49660.2025.10890501 ↗
43. Unmasking the internet: A survey of fine-grained network traffic analysis10.1109/COMST.2025.3545541 ↗