← 研踪 PaperTrailarXiv:2611.12442 · v1
When Handshakes Go Dark: An Adaptive Semantic-Sequential Fusion Framework for Encrypted Traffic Classification
首次提交 2026-11-09 22:01
版本更新 2026-11-09 22:01
雷达观测 2026-11-10 15:22
摘要
Encrypted traffic classification is essential for network security monitoring and traffic management. Self-supervised pre-training can learn reusable representations from large-scale unlabeled traffic, but TLS 1.3, QUIC, and privacy mechanisms such as Encrypted Client Hello (ECH) increasingly conceal application, handshake, and service-identifying information. Observable upper-layer bytes are therefore dominated by ciphertext, weakening the link between raw-byte patterns and application semantics and limiting model generalization. Moreover, the availability and discriminative value of observable information vary across protocols, protection profiles, and tasks, complicating classification across diverse scenarios. To address these challenges, we propose FLARE, a Field-aware Learning and Adaptive Representation Fusion framework for encrypted traffic classification. FLARE pre-trains a BERT-based packet encoder through Masked Field Prediction, which reconstructs masked tokens from field-structured context. During downstream fine-tuning, the parameters of the pre-trained packet encoder remain frozen, and a packet-level gated module adaptively combines protocol-semantic representations with directional packet-length representations. A flow-level encoder then models inter-packet dependencies for classification. We evaluate FLARE on eight datasets spanning diverse encrypted-traffic tasks, including CipherSpectrum and VisQUIC for strongly encrypted scenarios. FLARE achieves superior performance over baselines across the eight datasets, exceeding the strongest pre-trained baseline by 10.92 percentage points on QUIC website fingerprinting. These results demonstrate the effectiveness of field-aware pre-training and adaptive semantic-sequential fusion under constrained observability.
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-09 22:01 · 最新观测版本
When Handshakes Go Dark: An Adaptive Semantic-Sequential Fusion Framework for Encrypted Traffic Classification
Encrypted traffic classification is essential for network security monitoring and traffic management. Self-supervised pre-training can learn reusable representations from large-scale unlabeled traffic, but TLS 1.3, QUIC, and privacy mechanisms such as Encrypted Client Hello (ECH) increasingly conceal application, handshake, and service-identifying information. Observable upper-layer bytes are therefore dominated by ciphertext, weakening the link between raw-byte patterns and application semantics and limiting model generalization. Moreover, the availability and discriminative value of observable information vary across protocols, protection profiles, and tasks, complicating classification across diverse scenarios. To address these challenges, we propose FLARE, a Field-aware Learning and Adaptive Representation Fusion framework for encrypted traffic classification. FLARE pre-trains a BERT-based packet encoder through Masked Field Prediction, which reconstructs masked tokens from field-structured context. During downstream fine-tuning, the parameters of the pre-trained packet encoder remain frozen, and a packet-level gated module adaptively combines protocol-semantic representations with directional packet-length representations. A flow-level encoder then models inter-packet dependencies for classification. We evaluate FLARE on eight datasets spanning diverse encrypted-traffic tasks, including CipherSpectrum and VisQUIC for strongly encrypted scenarios. FLARE achieves superior performance over baselines across the eight datasets, exceeding the strongest pre-trained baseline by 10.92 percentage points on QUIC website fingerprinting. These results demonstrate the effectiveness of field-aware pre-training and adaptive semantic-sequential fusion under constrained observability.
查看此版本解读 →查看此版本原文 ↗