PACC: Protocol-Aware Cross-Layer Compression for Compact Network Traffic Representation

Zhaochen Guo; Honghao Wang; Tianyufei Zhou; Ronghua Li; Shinan Liu

cs.NIFeb 9, 2026

PACC: Protocol-Aware Cross-Layer Compression for Compact Network Traffic Representation

Authors: Zhaochen Guo, Honghao Wang, Tianyufei Zhou, Ronghua Li, Shinan Liu

Organizations: University of Electronic Science and Technology of China Chengdu, Sichuan, China · Renmin University of China Beijing, China · University of Hong Kong Hong Kong, China · Hong Kong Polytechnic University Hong Kong, China

Abstract

Network traffic classification underpins network security and management but faces growing challenges from pervasive encryption and evolving protocols. Existing representations involve clear trade-offs: hand-crafted flow statistics are efficient but lossy, raw-bit encodings can be accurate but costly, and pre-trained embeddings support transfer but often flatten the protocol stack and entangle cross-layer signals. We observe substantial redundancy both across and within network layers, which existing paradigms do not explicitly address, wasting capacity and encouraging shortcut learning that degrades generalization. To address this, we propose PACC, a redundancy-aware cross-layer representation framework. PACC models protocol layers as multiview inputs and learns faithful, compact projections factorized into shared (cross-layer) and private (layer-specific) components. It incorporates an information-preserving sparse segment representation to reduce structural repetition and supervised intra-layer filtering to suppress task-irrelevant semantic redundancy. A behavior-guided shared/private decomposition aligns cross-layer consensus while retaining layer-specific information, supported by information-theoretic analysis. Across encrypted application classification, IoT device identification, benign/malicious traffic classification, and Tor traffic detection, PACC achieves the best overall performance. On encrypted traffic, it achieves an F1 score of 0.9685, substantially outperforming existing baselines while using approximately 15x fewer computes and less GPU memory than the latest pre-trained traffic model.

Figures & tables

Figure 1: The shared–private principle for cross-layer traffic: capturing cross-layer consensus

I(X_{i};X_{j})

and layer-specific, task-relevant evidence such as

I(X_{i};Y\mid X_{j})

Panel of Figure 2 — Figure 2: Layer-wise analysis on CipherSpectrum. (a) Inter-layer consensus measured by $\mathrm{NMI}(X_{i};X_{j})$ . (b) Task relevance measured by $\mathrm{NMI}(X_{i};Y)$ , with intra-layer redundancy proxied by the compression ratio. Higher task relevance and lower compression ratio are preferred.

Figure 3: The overall framework of PACC . Compact behavioral features and lossless structural chunks are processed through task-aware semantic denoising, behavior-guided shared–private decomposition, and adaptive fusion. The right panel summarizes the optimization objectives.

Dataset	Metric	Flow Statistics		Raw Packets		Pretrained Embedding		PACC
Dataset	Metric	AppScanner	FlowPrint	TFE-GNN	nPrint	YaTC	NetMamba	PACC
Task: Encrypted Application Classification
CipherSpectrum	ACC	0.5356	0.0244	0.2149	0.3037	0.6678	0.5517	0.9685
	PRE	0.9278	0.0006	0.2147	0.3933	0.6642	0.5462	0.9694
	REC	0.5300	0.0244	0.2149	0.3037	0.6678	0.5517	0.9685
	F1	0.6737	0.0012	0.1642	0.2851	0.6633	0.5370	0.9685

Table 1: Classification Results Across Various Domain Traffic Datasets.

Method	Input / flow	Params	MACs / flow	Peak GPU	Latency / flow	Throughput	Prestage + training
YaTC	1600 px	1.866M	971.9M	158 MB	0.1482 ms	6,749/s	— $+1420.8s$
NetMamba	1600 px	1.867M	683.3M	456 MB	0.0481 ms	20,774/s	— $+1169.5s$
TFE-GNN	903 nodes / 5768 edges	44.364M	157.4M	1297 MB	6.2624 ms	160/s	$1991.7s$
PACC	608 elems	1.273M	47.2M	106 MB	0.0168 ms	59,660/s	$134.2s+743.0s$

Table 2: Efficiency comparison on CipherSpectrum. Input size is reported as model-consumed elements for PACC , pixels for packet-image baselines, and graph size for TFE-GNN. Lower is better for Params, MACs, Peak GPU, and Latency, while higher is better for Throughput. Pipeline time reports preprocessing and training; a dash denotes an unreported prestage cost rather than zero.

Panel of Figure 4 — Figure 4: Layer-wise analysis of PACC embeddings on CipherSpectrum. (a) Shared consensus measured by $\mathrm{NMI}(Z_{i}^{s};Z_{j}^{s})$ . (b) Shared-component task relevance measured by $\mathrm{NMI}(Z_{m}^{s};Y)$ , with redundancy proxied by the compression ratio. (c) Private-component shared-factor leakage measured by $I(Z_{m}^{p};Z_{g}\mid Z_{m}^{s})$ and residual task evidence measured by $I(Z_{m}^{p};Y\mid Z_{g})$ .

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

View	Extracted statistics	Captured behavior
Length scale	Packet count, total bytes, mean/std/median/90th-percentile/max packet length, and zero-payload ratio	Traffic volume and packet-size variation.
Direction	Forward/backward packet ratios, forward/backward byte ratios, and direction-switching rate	Endpoint dominance and request-response interaction.
Temporal	Summary statistics of log-compressed inter-arrival times	Transmission pace, timing fluctuation, and delayed responses.
Run-level bursts	Number of same-direction runs, average/max run length, and average/max run bytes	Alternating exchanges and directional bursts.
Distribution	Normalized histograms of packet lengths and log-compressed inter-arrival times	Distributional shape beyond low-order moments.
Frequency	Low-frequency Fourier magnitudes of signed packet-length and timing sequences	Burst periodicity and request-response rhythm.

Appendix

Table 4: Compact packet-sequence feature construction.

Dataset	Task	Classes	Flow Samples	Train/Val/Test	Flow-PCAP Size	Processed Input Size
CipherSpectrum	Encrypted Application	41	41,000	32,800 / 4,100 / 4,100	3.58 GB	224.39 MB
USTC-TFC	Benign/Malware Traffic	20	444,071	355,178 / 44,440 / 44,453	3.65 GB	1.60 GB
UNSW-IoT	IoT Device	22	41,176	32,980 / 4,098 / 4,098	671.14 MB	100.63 MB
ISCXTor/NonTor	Tor/Non-Tor	2	68,258	54,603 / 6,827 / 6,828	21.59 GB	178.44 MB

Appendix

Table 5: Dataset statistics under the final evaluation protocol.

Variant	CipherSpectrum	UNSW-IoT	USTC-TFC	ISCX Tor/NonTor
w/o $\mathcal{L}_{H,m}^{\mathrm{cls}}$	0.9425	0.9826	0.9892	0.9964
w/o $\mathcal{L}_{\mathrm{rec},m}$	0.9568	0.9779	0.9887	0.9911
w/o $\mathcal{L}_{\mathrm{red},m}$	0.9674	0.9849	0.9901	0.9998
w/o $\mathcal{L}_{\mathrm{share}}$	0.9669	0.9750	0.9895	0.9988
w/o $\mathcal{L}_{\mathrm{priv},m}$	0.9658	0.9837	0.9849	0.9986
PACC	0.9685	0.9852	0.9906	1.0000

Appendix

Table 6: Objective ablation across datasets. Values are macro F1-scores.

Variant	ACC	PRE	REC	F1
Behavioral MLP	$0.8833\pm 0.0046$	$0.8890\pm 0.0021$	$0.8833\pm 0.0046$	$0.8832\pm 0.0042$
Behavioral LightGBM	$0.8818\pm 0.0035$	$0.8857\pm 0.0037$	$0.8818\pm 0.0035$	$0.8824\pm 0.0033$
L2–L4 only	$0.6997\pm 0.0604$	$0.7225\pm 0.0614$	$0.6997\pm 0.0604$	$0.6919\pm 0.0634$
Raw features concatenation	$0.9022\pm 0.0039$	$0.9203\pm 0.0036$	$0.9022\pm 0.0039$	$0.9007\pm 0.0052$
Representations concatenation	$0.9430\pm 0.0212$	$0.9441\pm 0.0225$	$0.9430\pm 0.0222$	$0.9430\pm 0.0215$
PACC	$\mathbf{0.9571\pm 0.0122}$	$\mathbf{0.9581\pm 0.0125}$	$\mathbf{0.9571\pm 0.0122}$	$\mathbf{0.9570\pm 0.0122}$

Appendix

Table 7: Representation and fusion ablation on CipherSpectrum. Values are mean

\pm

sample standard deviation over 10 seeds.

Panel of Figure 6 — Figure 6: Sensitivity of macro F1-score on CipherSpectrum to individual filtering, reconstruction, shared, and private objective weights.

Table 13

Representation Learning

Representation learning develops data transformations that expose useful structure for prediction, transfer, generation, and control.

See all 773 papers

Aug 22, 2026

Pruned Traffic Trees: Native Semantic Compression with a Protocol-Structured Model Family for Encrypted Traffic Classification

Deep learning has achieved strong performance in encrypted traffic classification (ETC), yet its computational cost limits deployment on resource-constrained network devices such as routers and middleboxes. Existing compression methods mainly operate on weights, channels, hidden representations, or predictions, but do not explicitly determine which protocol fields and structural contexts should remain. We propose Pruned Traffic Trees (PTT), a three-level protocol-structured model family that treats native protocol structures as compression units. PTT-Full learns protocol-structured representations and field salience from complete Protocol Tree Graphs (PTGs), with flow-level self-supervised learning and protocol-presence-aware sparse execution. The learned salience and TopK+

k

closure construct Distilled PTGs (PTG-Ds) for PTT-Distilled, while PTT-Lite inherits this topology and reduces width through structure-aligned transfer and flow-level logits distillation. Under flow-disjoint and Strong Information Information (SII)-masked settings, PTT-Full achieves Macro-F1 scores of 0.9519 and 0.9416 on CSTNET-TLS1.3 and CipherSpectrum, while PTT-Lite retains 0.9325 and 0.9136 with 80.3% and 61.3% fewer parameters, 98.85% and 98.78% lower effective GFLOPs, and 8.75

\times

and 8.46

\times

CPU inference speedups. These results demonstrate that treating protocol structure itself as the compression object enables effective performance-efficiency trade-offs for lightweight ETC.

Yuantu Luo, Jun Tao, Xiangyu Xu +2

School of Cyber Science and Engineering, Southeast University, Nanjing, China · School of Computer Science and Engineering, Southeast University, Nanjing, China

Encrypted Traffic Classification Encrypted Network Traffic Analysis Model Compression Neural Network Compression

Ask PDF

Aug 5, 2026

Learning Compression Rules for Network Traffic

We study the problem of learning compact rule-based compressors for structured network traffic. Each packet is a record of header fields that are highly redundant within a flow, and a compressor is a small set of rules matching such records and replacing predictable fields with short codes. We cast rule learning as a two-stage problem: (i) an unsupervised structure-discovery stage that recursively partitions training packets using a normalized entropy-ratio criterion robust to small samples, and (ii) a constrained selection stage that uses dynamic programming to pick the rule subset maximizing expected compression gain under a hard budget on the number of installable rules. We instantiate the framework on Static Context Header Compression (SCHC), the IETF standard for rule-based header compression in constrained networks, and evaluate it on four real-world Internet-of-Things and 5G core-network datasets. Our method, Robust Entropy Clustering for Adaptive comPression (RECAP), surpasses expert-engineered rule sets with a small number of learned rules and removes the need for manual rule design.

Quentin Lampin, Éloi Sainte-Beuve, Louis-Adrien Dufrène +2

Orange Research · 1Orange Research · Université Grenoble Alpes +1

Topic pending

Ask PDF

May 29, 2026

GETA: Generalized Encrypted Traffic Analysis

Traditional traffic analysis is being fundamentally challenged by the rapid adoption of encryption, tunnelling, and privacy-preserving protocols, which increasingly obscure packet payloads and limit the usefulness of Deep Packet Inspection (DPI). Although machine learning has advanced encrypted traffic analysis, existing approaches often remain tied to protocol-specific header features, depend on large labelled datasets, and degrade when deployed across heterogeneous network environments. We present GETA, a protocol-agnostic framework for encrypted traffic analysis that models network flows as multivariate time series using only traffic metadata, thereby avoiding reliance on packet payloads or header semantics. GETA combines meta-learning, embedding refinement, and self-attention to support few-shot adaptation to previously unseen domains with minimal labelled data. Across nine public datasets spanning application identification, VPN traffic classification, IoT device fingerprinting, and attack detection, GETA consistently outperforms state-of-the-art baselines. These results show that GETA offers a practical and generalisable foundation for robust traffic analysis in modern encrypted networks.

Ransika Gunasekara, Rahat Masood, Salil Kanhere

University of New South Wales (UNSW)

Domain Adaptation Network Intrusion Detection Encrypted Network Traffic Analysis Cybersecurity Encrypted Traffic Classification

Ask PDF

Abstract

Representation Learning

Explore similar work

Pruned Traffic Trees: Native Semantic Compression with a Protocol-Structured Model Family for Encrypted Traffic Classification

Learning Compression Rules for Network Traffic

GETA: Generalized Encrypted Traffic Analysis