Work

Beyond Byte-Level Modeling: Structure-Aware and Adaptive Traffic Classification for Encrypted Networks

Year: 2026

Type: article

Abstract: The widespread adoption of encryption protocols such as TLS 1.3 has significantly reduced the visibility of packet payloads, limiting the effectiveness of traditional traffic analysis methods. Recent deep learning approaches attempt to learn representations directly from raw byte sequences; however, in encrypted environments, byte-level patterns often exhibit high entropy and unstable ordering, raising concerns about their reliability. In this work, we revisit the roles of content and structural information in traffic classification and argue that effective modeling should move beyond content-only representations. We propose a structure-aware framework that models hierarchical relationships across fields, layers, and sessions while representing byte information using compact, permutation-invariant summaries. In addition, we introduce a hierarchical shuffle pretraining strategy to capture relational dependencies and an adaptive inter-level gating mechanism to dynamically integrate multi-level representations. Extensive experiments on multiple datasets with varying levels of encryption demonstrate that byte-level sequential patterns are not always essential, while structural information provides consistent complementary cues. Furthermore, the importance of different structural levels varies across datasets, highlighting the need for adaptive multi-level modeling. The proposed method achieves strong performance across diverse datasets, including highly encrypted traffic, while maintaining robustness under domain shifts and limited data scenarios. These results suggest that combining compact content representations with structural context and adaptive integration is a promising direction for encrypted traffic analysis.

Source: Electronics

DOI: 10.3390/electronics15091828