Abstract: Currently, encrypted traffic classification has attracted significant research attention. However, many existing methods extract only flow-level features, which are often unreliable for short flows due to the instability of statistical characteristics. Moreover, they tend to treat packet headers and payloads equally, failing to explore the potential correlations between individual bytes. In addition, convolutional neural networks (CNNs) and recurrent neural networks (RNNs) struggle to capture the discriminative information embedded in raw bytes. To address these challenges, we propose a fine-grained encrypted traffic classification model（ETC-SAT）, which integrates GraphSAGE and Graph Attention Networks (GAT). This method constructs byte-level traffic graphs based on pointwise mutual information (PMI). Specifically, a dual embedding layer is designed to embed the byte-level traffic graphs into the graph model. Furthermore, we develop a traffic graph encoder that combines GraphSAGE and GAT: GraphSAGE provides stable neighbor feature aggregation, while GAT introduces an attention mechanism to enhance selective aggregation, thereby improving the quality of graph feature extraction. An adaptive deep feature fusion mechanism is then employed to integrate information from separately processed packet headers and payloads, resulting in stronger feature representations. Experimental results on two public datasets—ISCX-VPN2016 and ISCX-Tor2016—demonstrate that the ETC-SAT model can effectively identify types of encrypted traffic and significantly outperforms baseline methods in terms of classification performance.

摘要： 目前，加密流量分类的研究备受关注。然而，现有的许多加密流量分类方法仅提取流级特征，由于统计特征不可靠而无法处理短流量，或者将头部和有效负载同等对待，导致无法探索字节之间的潜在关联。此外，卷积神经网络（CNN）和循环神经网络（RNN）存在着无法获取原始字节中包含的判别信息的问题。因此，提出了一种GraphSAGE和GAT相结合的细粒度加密流量分类模型（ETC-SAT），该方法基于点互信息（PMI）来构建字节级流量图。具体而言，在该方法中设计了一个双重嵌入层，该层用于将字节级流量图嵌入到图模型当中。同时还设计了一个GraphSAGE和GAT相结合的流量图编码器，该编码器中GraphSAGE提供了稳定的邻居特征聚合方式，GAT通过引入注意力机制增强选择性聚合，从而更有利于图特征的提取。之后应用自适应深度特征融合机制，该机制可以将分别处理的数据包头部和有效载荷的信息融合在一起以获得更强的特征表示。在ISCX-VPN2016和ISCX-Tor2016这两个公开数据集上的实验结果表明，ETC-SAT算法能够有效识别加密流量的类型，而且性能明显优于基线算法。