PACC: Protocol-Aware Cross-Layer Compression for Compact Network Traffic Representation

Zhaochen Guo; Honghao Wang; Tianyufei Zhou; Ronghua Li; Shinan Liu

cs.NIFeb 9, 2026

PACC: Protocol-Aware Cross-Layer Compression for Compact Network Traffic Representation

Authors: Zhaochen Guo, Honghao Wang, Tianyufei Zhou, Ronghua Li, Shinan Liu

Organizations: University of Electronic Science and Technology of China Chengdu, Sichuan, China · Renmin University of China Beijing, China · University of Hong Kong Hong Kong, China · Hong Kong Polytechnic University Hong Kong, China

Abstract

Network traffic classification underpins network security and management but faces growing challenges from pervasive encryption and evolving protocols. Existing representations involve clear trade-offs: hand-crafted flow statistics are efficient but lossy, raw-bit encodings can be accurate but costly, and pre-trained embeddings support transfer but often flatten the protocol stack and entangle cross-layer signals. We observe substantial redundancy both across and within network layers, which existing paradigms do not explicitly address, wasting capacity and encouraging shortcut learning that degrades generalization. To address this, we propose PACC, a redundancy-aware cross-layer representation framework. PACC models protocol layers as multiview inputs and learns faithful, compact projections factorized into shared (cross-layer) and private (layer-specific) components. It incorporates an information-preserving sparse segment representation to reduce structural repetition and supervised intra-layer filtering to suppress task-irrelevant semantic redundancy. A behavior-guided shared/private decomposition aligns cross-layer consensus while retaining layer-specific information, supported by information-theoretic analysis. Across encrypted application classification, IoT device identification, benign/malicious traffic classification, and Tor traffic detection, PACC achieves the best overall performance. On encrypted traffic, it achieves an F1 score of 0.9685, substantially outperforming existing baselines while using approximately 15x fewer computes and less GPU memory than the latest pre-trained traffic model.

Figures & tables

Figure 1: The shared–private principle for cross-layer traffic: capturing cross-layer consensus

I(X_{i};X_{j})

and layer-specific, task-relevant evidence such as

I(X_{i};Y\mid X_{j})

Panel of Figure 2 — Figure 2: Layer-wise analysis on CipherSpectrum. (a) Inter-layer consensus measured by $\mathrm{NMI}(X_{i};X_{j})$ . (b) Task relevance measured by $\mathrm{NMI}(X_{i};Y)$ , with intra-layer redundancy proxied by the compression ratio. Higher task relevance and lower compression ratio are preferred.

Figure 3: The overall framework of PACC . Compact behavioral features and lossless structural chunks are processed through task-aware semantic denoising, behavior-guided shared–private decomposition, and adaptive fusion. The right panel summarizes the optimization objectives.

Dataset	Metric	Flow Statistics		Raw Packets		Pretrained Embedding		PACC
Dataset	Metric	AppScanner	FlowPrint	TFE-GNN	nPrint	YaTC	NetMamba	PACC
Task: Encrypted Application Classification
CipherSpectrum	ACC	0.5356	0.0244	0.2149	0.3037	0.6678	0.5517	0.9685
	PRE	0.9278	0.0006	0.2147	0.3933	0.6642	0.5462	0.9694
	REC	0.5300	0.0244	0.2149	0.3037	0.6678	0.5517	0.9685
	F1	0.6737	0.0012	0.1642	0.2851	0.6633	0.5370	0.9685

Table 1: Classification Results Across Various Domain Traffic Datasets.

Method	Input / flow	Params	MACs / flow	Peak GPU	Latency / flow	Throughput	Prestage + training
YaTC	1600 px	1.866M	971.9M	158 MB	0.1482 ms	6,749/s	— $+1420.8s$
NetMamba	1600 px	1.867M	683.3M	456 MB	0.0481 ms	20,774/s	— $+1169.5s$
TFE-GNN	903 nodes / 5768 edges	44.364M	157.4M	1297 MB	6.2624 ms	160/s	$1991.7s$
PACC	608 elems	1.273M	47.2M	106 MB	0.0168 ms	59,660/s	$134.2s+743.0s$

Table 2: Efficiency comparison on CipherSpectrum. Input size is reported as model-consumed elements for PACC , pixels for packet-image baselines, and graph size for TFE-GNN. Lower is better for Params, MACs, Peak GPU, and Latency, while higher is better for Throughput. Pipeline time reports preprocessing and training; a dash denotes an unreported prestage cost rather than zero.

Panel of Figure 4 — Figure 4: Layer-wise analysis of PACC embeddings on CipherSpectrum. (a) Shared consensus measured by $\mathrm{NMI}(Z_{i}^{s};Z_{j}^{s})$ . (b) Shared-component task relevance measured by $\mathrm{NMI}(Z_{m}^{s};Y)$ , with redundancy proxied by the compression ratio. (c) Private-component shared-factor leakage measured by $I(Z_{m}^{p};Z_{g}\mid Z_{m}^{s})$ and residual task evidence measured by $I(Z_{m}^{p};Y\mid Z_{g})$ .

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

View	Extracted statistics	Captured behavior
Length scale	Packet count, total bytes, mean/std/median/90th-percentile/max packet length, and zero-payload ratio	Traffic volume and packet-size variation.
Direction	Forward/backward packet ratios, forward/backward byte ratios, and direction-switching rate	Endpoint dominance and request-response interaction.
Temporal	Summary statistics of log-compressed inter-arrival times	Transmission pace, timing fluctuation, and delayed responses.
Run-level bursts	Number of same-direction runs, average/max run length, and average/max run bytes	Alternating exchanges and directional bursts.
Distribution	Normalized histograms of packet lengths and log-compressed inter-arrival times	Distributional shape beyond low-order moments.
Frequency	Low-frequency Fourier magnitudes of signed packet-length and timing sequences	Burst periodicity and request-response rhythm.

Appendix

Table 4: Compact packet-sequence feature construction.

Dataset	Task	Classes	Flow Samples	Train/Val/Test	Flow-PCAP Size	Processed Input Size
CipherSpectrum	Encrypted Application	41	41,000	32,800 / 4,100 / 4,100	3.58 GB	224.39 MB
USTC-TFC	Benign/Malware Traffic	20	444,071	355,178 / 44,440 / 44,453	3.65 GB	1.60 GB
UNSW-IoT	IoT Device	22	41,176	32,980 / 4,098 / 4,098	671.14 MB	100.63 MB
ISCXTor/NonTor	Tor/Non-Tor	2	68,258	54,603 / 6,827 / 6,828	21.59 GB	178.44 MB

Appendix

Table 5: Dataset statistics under the final evaluation protocol.

Variant	CipherSpectrum	UNSW-IoT	USTC-TFC	ISCX Tor/NonTor
w/o $\mathcal{L}_{H,m}^{\mathrm{cls}}$	0.9425	0.9826	0.9892	0.9964
w/o $\mathcal{L}_{\mathrm{rec},m}$	0.9568	0.9779	0.9887	0.9911
w/o $\mathcal{L}_{\mathrm{red},m}$	0.9674	0.9849	0.9901	0.9998
w/o $\mathcal{L}_{\mathrm{share}}$	0.9669	0.9750	0.9895	0.9988
w/o $\mathcal{L}_{\mathrm{priv},m}$	0.9658	0.9837	0.9849	0.9986
PACC	0.9685	0.9852	0.9906	1.0000

Appendix

Table 6: Objective ablation across datasets. Values are macro F1-scores.

Variant	ACC	PRE	REC	F1
Behavioral MLP	$0.8833\pm 0.0046$	$0.8890\pm 0.0021$	$0.8833\pm 0.0046$	$0.8832\pm 0.0042$
Behavioral LightGBM	$0.8818\pm 0.0035$	$0.8857\pm 0.0037$	$0.8818\pm 0.0035$	$0.8824\pm 0.0033$
L2–L4 only	$0.6997\pm 0.0604$	$0.7225\pm 0.0614$	$0.6997\pm 0.0604$	$0.6919\pm 0.0634$
Raw features concatenation	$0.9022\pm 0.0039$	$0.9203\pm 0.0036$	$0.9022\pm 0.0039$	$0.9007\pm 0.0052$
Representations concatenation	$0.9430\pm 0.0212$	$0.9441\pm 0.0225$	$0.9430\pm 0.0222$	$0.9430\pm 0.0215$
PACC	$\mathbf{0.9571\pm 0.0122}$	$\mathbf{0.9581\pm 0.0125}$	$\mathbf{0.9571\pm 0.0122}$	$\mathbf{0.9570\pm 0.0122}$

Appendix

Table 7: Representation and fusion ablation on CipherSpectrum. Values are mean

\pm

sample standard deviation over 10 seeds.

Panel of Figure 6 — Figure 6: Sensitivity of macro F1-score on CipherSpectrum to individual filtering, reconstruction, shared, and private objective weights.

Table 13

Representation Learning

Representation learning develops data transformations that expose useful structure for prediction, transfer, generation, and control.

See all 773 papers

Pruned Traffic Trees: Native Semantic Compression with a Protocol-Structured Model Family for Encrypted Traffic Classification
Aug 22, 2026Yuantu Luo, Jun Tao, Xiangyu Xu +2Encrypted Traffic Classification Encrypted Network Traffic Analysis
School of Cyber Science and Engineering, Southeast University, Nanjing, China · School of Computer Science and Engineering, Southeast University, Nanjing, China
Learning Compression Rules for Network Traffic
Aug 5, 2026Quentin Lampin, Éloi Sainte-Beuve, Louis-Adrien Dufrène +2
Orange Research · 1Orange Research · Université Grenoble Alpes +1
GETA: Generalized Encrypted Traffic Analysis
May 29, 2026Ransika Gunasekara, Rahat Masood, Salil KanhereDomain Adaptation Network Intrusion Detection
University of New South Wales (UNSW)

Aug 22, 2026J/K move · Enter open · S save

Pruned Traffic Trees: Native Semantic Compression with a Protocol-Structured Model Family for Encrypted Traffic Classification

Yuantu Luo, Jun Tao, Xiangyu Xu, Linxiao Yu+1

School of Cyber Science and Engineering, Southeast University, Nanjing, China · School of Computer Science and Engineering, Southeast University, Nanjing, China

Encrypted Traffic Classification Encrypted Network Traffic Analysis Model Compression Neural Network Compression

Open paper AskPDF arXiv

Deep learning has achieved strong performance in encrypted traffic classification (ETC), yet its computational cost limits deployment on resource-constrained network devices such as routers and middleboxes. Existing compression methods mainly operate on weights, channels, hidden representations, or predictions, but do not explicitly determine which protocol fields and structural contexts should remain. We propose Pruned Traffic Trees (PTT), a three-level protocol-structured model family that treats native protocol structures as compression units. PTT-Full learns protocol-structured representations and field salience from complete Protocol Tree Graphs (PTGs), with flow-level self-supervised learning and protocol-presence-aware sparse execution. The learned salience and TopK+

k

closure construct Distilled PTGs (PTG-Ds) for PTT-Distilled, while PTT-Lite inherits this topology and reduces width through structure-aligned transfer and flow-level logits distillation. Under flow-disjoint and Strong Information Information (SII)-masked settings, PTT-Full achieves Macro-F1 scores of 0.9519 and 0.9416 on CSTNET-TLS1.3 and CipherSpectrum, while PTT-Lite retains 0.9325 and 0.9136 with 80.3% and 61.3% fewer parameters, 98.85% and 98.78% lower effective GFLOPs, and 8.75

\times

and 8.46

\times

CPU inference speedups. These results demonstrate that treating protocol structure itself as the compression object enables effective performance-efficiency trade-offs for lightweight ETC.

Abstract

Representation Learning

Explore similar work

Pruned Traffic Trees: Native Semantic Compression with a Protocol-Structured Model Family for Encrypted Traffic Classification

Learning Compression Rules for Network Traffic

GETA: Generalized Encrypted Traffic Analysis