PACC: Protocol-Aware Cross-Layer Compression for Compact Network Traffic Representation

TL;DR

PACC introduces a protocol-aware, cross-layer compression framework that effectively reduces redundancy in network traffic representations, improving classification accuracy and efficiency across various network security tasks.

Contribution

It proposes a novel multi-view, layer-aware representation method that explicitly factorizes shared and private information across network protocol layers.

Findings

Achieves up to 12.9% accuracy improvement on encrypted traffic classification.

Improves end-to-end efficiency by up to 3.16x.

Outperforms feature-engineered, raw-bit, and foundation-model baselines.

Abstract

Network traffic classification is a core primitive for network security and management, yet it is increasingly challenged by pervasive encryption and evolving protocols. A central bottleneck is representation: hand-crafted flow statistics are efficient but often too lossy, raw-bit encodings can be accurate but are costly, and recent pre-trained embeddings provide transfer but frequently flatten the protocol stack and entangle signals across layers. We observe that real traffic contains substantial redundancy both across network layers and within each layer; existing paradigms do not explicitly identify and remove this redundancy, leading to wasted capacity, shortcut learning, and degraded generalization. To address this, we propose PACC, a redundancy-aware, layer-aware representation framework. PACC treats the protocol stack as multi-view inputs and learns compact layer-wise projections that remain faithful to each layer while explicitly factorizing representations into shared (cross-layer) and private (layer-specific) components. We operationalize these goals with a joint objective that preserves layer-specific information via reconstruction, captures shared structure via contrastive mutual-information learning, and maximizes task-relevant information via supervised losses, yielding compact latents suitable for efficient inference. Across datasets covering encrypted application classification, IoT device identification, and intrusion detection, PACC consistently outperforms feature-engineered and raw-bit baselines. On encrypted subsets, it achieves up to a 12.9% accuracy improvement over nPrint. PACC matches or surpasses strong foundation-model baselines. At the same time, it improves end-to-end efficiency by up to 3.16x.