One Train for Two Tasks: An Encrypted Traffic Classification Framework Using Supervised Contrastive Learning

TL;DR

This paper introduces CLE-TFE, a contrastive learning-based framework that improves encrypted traffic classification by jointly learning packet and flow-level tasks with enhanced representations, achieving high accuracy with low computational cost.

Contribution

It proposes a novel contrastive learning enhanced model with cross-level multi-task training for encrypted traffic classification, capturing semantic-invariant features efficiently.

Findings

Achieves state-of-the-art performance on traffic classification tasks.

Reduces computational overhead to about 1/14 of pre-trained models.

Effectively captures fine-grained byte-level semantic features.

Abstract

As network security receives widespread attention, encrypted traffic classification has become the current research focus. However, existing methods conduct traffic classification without sufficiently considering the common characteristics between data samples, leading to suboptimal performance. Moreover, they train the packet-level and flow-level classification tasks independently, which is redundant because the packet representations learned in the packet-level task can be exploited by the flow-level task. Therefore, in this paper, we propose an effective model named a Contrastive Learning Enhanced Temporal Fusion Encoder (CLE-TFE). In particular, we utilize supervised contrastive learning to enhance the packet-level and flow-level representations and perform graph data augmentation on the byte-level traffic graph so that the fine-grained semantic-invariant characteristics between bytes can be captured through contrastive learning. We also propose cross-level multi-task learning, which simultaneously accomplishes the packet-level and flow-level classification tasks in the same model with one training. Further experiments show that CLE-TFE achieves the best overall performance on the two tasks, while its computational overhead (i.e., floating point operations, FLOPs) is only about 1/14 of the pre-trained model (e.g., ET-BERT). We release the code at https://github.com/ViktorAxelsen/CLE-TFE