Encrypted network traffic classification is an important research topic in the field of network security. Although deep learning-based methods have made progress, they still face three main challenges: first, the semantic information in encrypted traffic is inadequately represented, making it difficult for existing methods to effectively capture the hierarchical interaction relationships between packet-level and flow-level features; second, models rely on large amounts of labeled data for supervised training, resulting in high training costs and limited generalization ability in new scenarios; third, in existing self-supervised methods, the functions of the encoder and decoder are coupled, which restricts the full potential of the encoder’s representation learning. To address these issues, this paper proposes an Enhanced Traffic Classifier (ETC) based on self-supervised feature learning. The model first constructs a multi-level interactive traffic representation matrix, converting raw traffic into structured grayscale images that fuse packet-level and flow-level temporal features, thereby addressing the problem of missing semantic information. On this basis, an improved Masked Image Modeling Vision Transformer architecture is adopted. Through a three-stage decoupled design of encoder–regressor–decoder, the encoder focuses solely on feature extraction, the regressor performs masked representation prediction, and the decoder is only responsible for image reconstruction, thereby fully unleashing the encoder’s feature learning capability. Furthermore, during the fine-tuning stage, an Attentive Probing classification mechanism is introduced to replace the traditional linear classification head. By using learnable class query vectors to dynamically focus on semantic regions relevant to the classification target, the model’s recognition accuracy and robustness are further improved. Experiments are conducted on five public datasets, including USTC-TFC2016 and CICIoT2022, as well as a self-built Human-Internet dataset. The results show that ETC significantly outperforms mainstream methods such as YaTC and ET-BERT in core metrics including accuracy and F1-score, while also demonstrating strong generalization in few-shot scenarios.
Jiang et al. (Fri,) studied this question.