Mean Masked Autoencoder with Flow-Mixing for Encrypted Traffic Classification

TL;DR

This paper introduces MMAE, a novel self-supervised pre-training framework for encrypted traffic classification that leverages flow mixing and packet importance to improve multi-granularity understanding and discriminative feature learning.

Contribution

The paper proposes MMAE, combining flow mixing, self-distillation, and packet importance masking to enhance encrypted traffic classification beyond isolated flow analysis.

Findings

MMAE achieves state-of-the-art results on multiple datasets.

FlowMix improves model robustness against distorted tokens.

Packet-importance masking enhances semantic understanding.

Abstract

Network traffic classification using self-supervised pre-training models based on Masked Autoencoders (MAE) has demonstrated a huge potential. However, existing methods are confined to isolated byte-level reconstruction of individual flows, lacking adequate perception of the multi-granularity contextual relationship in traffic. To address this limitation, we propose Mean MAE (MMAE), a teacher-student MAE paradigm with flow mixing strategy for building encrypted traffic pre-training model. MMAE employs a self-distillation mechanism for teacher-student interaction, where the teacher provides unmasked flow-level semantic supervision to advance the student from local byte reconstruction to multi-granularity comprehension. To break the information bottleneck in individual flows, we introduce a dynamic Flow Mixing (FlowMix) strategy to replace traditional random masking mechanism. By constructing challenging cross-flow mixed samples with interferences, it compels the model to learn discriminative representations from distorted tokens. Furthermore, we design a Packet-importance aware Mask Predictor (PMP) equipped with an attention bias mechanism that leverages packet-level side-channel statistics to dynamically mask tokens with high semantic density. Numerous experiments on a number of datasets covering encrypted applications, malware, and attack traffic demonstrate that MMAE achieves state-of-the-art performance. The code is available at https://github.com/lx6c78/MMAE