Bridging packet and session: Cross-level dual-attention networks for encrypted traffic classification
Year: 2026
Type: article
Abstract: The widespread adoption of encryption technologies has greatly increased the complexity of network traffic classification, as plaintext features such as DNS are increasingly unavailable. Traditional payload-based approaches fail under strong encryption, while statistical and deep learning methods relying on single-level information often struggle to capture comprehensive traffic patterns. To address these challenges, we propose Cross-Level Encrypted Traffic (CLET), a novel classification model that integrates session-level and packet-level representations to capture comprehensive patterns in encrypted traffic. At the session level, CLET constructs an 87-dimensional attribute set encompassing certificate characteristics, temporal behaviors, and spatial distributions, providing a robust global view of each flow. At the packet level, CLET introduces a compact 13-dimensional attribute set processed by a hybrid CNN-Transformer network with dual attention mechanisms, learning fine-grained temporal and spatial dependencies while avoiding redundant information. By jointly leveraging global and local representations, CLET mitigates information loss and enhances feature discriminability. Experiments on the LFETT2021 and ISCX-VPN datasets show that CLET outperforms state-of-the-art baselines, demonstrating the effectiveness of cross-level learning for encrypted traffic classification.
Authors: Jieming Gu, Yue Zhong, Xiangzhan Yu
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $1,990
OpenAlex ID: W7124948394