cs.CRMar 31, 2026

TrafficMoE: Heterogeneity-aware Mixture of Experts for Encrypted Traffic Classification

Authors: Qing He, Xiaowei Fu, Lei Zhang

Organizations: School of Microelectronics and Communication Engineering, Chongqing University, Chongqing 400044, China.

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Encrypted traffic classification is a critical task for network security. While deep learning has advanced this field, the occlusion of payload semantics by encryption severely challenges standard modeling approaches. Most existing frameworks rely on static and homogeneous pipelines that apply uniform parameter sharing and static fusion strategies across all inputs. This one-size-fits-all static design is inherently flawed: by forcing structured headers and randomized payloads into a unified processing pipeline, it inevitably entangles the raw protocol signals with stochastic encryption noise, thereby degrading the fine-grained discriminative features. In this paper, we propose TrafficMoE, a framework that breaks through the bottleneck of static modeling by establishing a Disentangle-Filter-Aggregate (DFA) paradigm. Specifically, to resolve the structural between-components conflict, the architecture disentangles headers and payloads using dual-branch sparse Mixture-of-Experts (MoE), enabling modality-specific modeling. To mitigate the impact of stochastic noise, an uncertainty-aware filtering mechanism is introduced to quantify reliability and selectively suppress high-variance representations. Finally, to overcome the limitations of static fusion, a routing-guided strategy aggregates cross-modality features dynamically, that adaptively weighs contributions based on traffic context. With this DFA paradigm, TrafficMoE maximizes representational efficiency by focusing solely on the most discriminative traffic features. Extensive experiments on six datasets demonstrate TrafficMoE consistently outperforms state-of-the-art methods, validating the necessity of heterogeneity-aware modeling in encrypted traffic analysis. The source code is publicly available at https://github.com/Posuly/TrafficMoE_main.

Figures & tables

Fig. 1: Comparison between existing modeling paradigms and the proposed TrafficMoE framework. Existing paradigm (a) typically process heterogeneous traffic components in a unified manner with static fusion strategies, whereas TrafficMoE (b) explicitly disentangles headers and payloads, incorporates uncertainty-aware filtering (UF), and performs conditional aggregation (CA) guided by MoE routing probabilities for adaptive and context-aware integration.
Fig. 2: Overview of the TrafficMoE framework. The dual-branch MoE architecture explicitly models heterogeneous traffic components, i.e., the Header and Payload branches, which can capture intra-modality patterns, respectively. The uncertainty-aware filter suppresses unreliable tokens, i.e., noisy traffic components, and the conditional aggregation module fuses the final purified features across two modalities (header vs. payload) in a routing-guided manner for encrypted traffic classification.
Fig. 3: End-to-end preprocessing pipeline for encrypted traffic. Raw traffic is first segmented into flows using canonical 5-tuple session identification. These flows are further decomposed into packet-level units through packets splitting. Each packet undergoes byte-level cropping and zero-padding to produce fixed-dimensional header and payload segments. The resulting sequence of fixed packets is then partitioned into non-overlapping strides, enabling consistent, length-normalized inputs for subsequent neural processing while preserving temporal ordering and structural heterogeneity.
Fig. 4: The basic idea of UF, which quantifies the alignment uncertainty via Shannon entropy ( HH ). Sharp distributions in green mean low entropy HH and identify reliable metadata to be retained (i.e., the filter g→1g\to 1 ), while dispersed distributions in red mean high entropy HH and identify noisy components to be suppressed (i.e., the filter g→0g\to 0 ).
Fig. 5: Training pipeline of the proposed framework. In the pre-training stage, masked language modeling (MLM) is used to learn contextual representations from header and payload sequences without supervision. In the fine-tuning stage, the pretrained encoders are fine-tuned end-to-end on labeled traffic data through a standard cross-entropy classification objective.
Dataset# Sample# Category
CSTNET-TLS 1.346,356120
ISCX-Tor201614,56916
CIC-IoT202222,6346
USTC-TFC201650,67720
ISCX-VPN (APP)2,32912
ISCX-VPN (Service)3,69417
TABLE I: Statistical Information of Fine-tuning Datasets
DatasetISCX-Tor2016CSTNET-TLSCIC-IoT2022
MetricACPRRCF1ACPRRCF1ACPRRCF1
AppScanner [ 33 ]0.90750.77280.80330.78480.74410.72320.69630.70230.85910.88580.79960.8288
BIND [ 34 ]0.90100.85820.83540.84390.47100.43150.42260.41890.73490.67540.63870.6435
CUMUL [ 35 ]0.77250.64630.64430.64010.59210.55280.56040.54930.70190.67460.70290.6687
DF [ 36 ]0.74010.59180.56110.54920.57290.53980.51440.49330.27460.21400.18700.1647
FSNet [ 13 ]0.69670.61590.60610.60280.78140.76700.73160.73110.80770.82500.83330.7804
TABLE II: Comparison results on ISCX-Tor2016, CSTNET-TLS, and CIC-IoT2022 datasets.
DatasetUSTC-TFCISCX-VPN (APP)ISCX-VPN (Service)
MetricACPRRCF1ACPRRCF1ACPRRCF1
AppScanner [ 33 ]0.85850.91080.90340.89760.79450.69500.69750.68740.86810.87100.84350.8546
BIND [ 34 ]0.79450.78110.70610.71150.69510.62660.54150.56090.83450.77690.77140.7699
CUMUL [ 35 ]0.71730.50630.58120.51830.54800.48390.46150.45540.70990.69590.68930.6884
DF [ 36 ]0.64520.40190.36850.30590.49350.24490.25920.22890.50180.46640.47730.3934
FSNet [ 13 ]0.75580.81670.84070.80420.63160.48990.48330.46770.90870.90510.90540.9051
TABLE III: Comparison results on USTC-TFC, ISCX-VPN (APP), and ISCX-VPN (Service) datasets.
MethodAccuracy (%)F1 (%)
Heterogeneous MoE (Full)97.6597.65
Homogeneous MoE92.2192.32
Header-only75.6575.65
Payload-only45.1245.22
TABLE IV: Ablation on Heterogeneous MoE Structure.
Fig. 6: Impact of the expert number in MoE for Header branch, Payload branch and the Global module, respectively, on ISCX-Tor2016 and CSTNET-TLS datasets. Clearly, MoE further improves representations.
MethodAccuracy (%)F1 (%)
TrafficMoE97.6597.65
w/o UF95.6995.69
w/o CA96.3396.33
w/o Cross-Modal Interaction96.8796.87
w/o Pre-training73.2573.25
TABLE V: Ablation study of the TrafficMoE. Accuracy and F1-score are reported under different filtering configurations.
Fig. 7: Class-wise expert behavior analysis of TrafficMoE. The average expert activation for each traffic class at the early training stage (Epoch 0) and converged stage (Epoch 120) is visualized, respectively. As training progresses, the routing distributions evolve from dispersed and class-agnostic patterns to structured and class-specific activations, indicating the expert specialization is aligned with semantic traffic categories.
Fig. 8: Visualization of UF module before and after filtering. The heatmaps illustrate the relative feature magnitude of interleaved packet sequences across different traffic samples. The red dashed lines delineate the boundaries between individual network packets, while the white dotted lines separate the header and payload segments within each packet. After filtering, UF drastically suppresses the noisy components with high-energy activations in encrypted payload segments.
More in this topic

Encrypted Traffic Classification

See all 15 papers

Explore similar work

CardsList
Jun 3, 2026

Treat Traffic Like Trees: A Semantic-Preserving Hierarchical Graph-Based Expert Framework for Encrypted Traffic Analysis

Graph-based deep learning methods have been widely employed in encrypted traffic analysis to exploit latent correlations across different granularities. However, while complex preprocessing pipelines and sophisticated model structures often achieve strong performance, they may obscure inherent protocol semantics during representation learning. Moreover, the hierarchical structure of protocol layers and their corresponding fields, defined by protocol specifications and routinely utilized in manual traffic analysis, remains underexplored in existing learning frameworks. In this paper, we propose Protocol Tree Graph Attention with Mixture of Experts (PTGAMoE), a semantic-preserving hierarchical graph-based expert framework for encrypted traffic analysis. The field-based graph construction and expert committee design enable PTGAMoE to quantify the model's preferences for specific fields and protocols. Extensive experimental results on representative benchmark datasets under strict no-data-leakage settings demonstrate that PTGAMoE significantly outperforms state-of-the-art (SOTA) models. Furthermore, the semantic-preserving design provides interpretable insights into protocol-level feature importance and expert-level contributions, reflecting the model's decision-making logic in encrypted traffic classification tasks.

Yuantu Luo, Jun Tao, Linxiao Yu +1

School of Cyber Science and Engineering, Southeast University, Nanjing 211189, China · Purple Mountain Laboratories, Nanjing 210096, China · Engineering Research Center of Blockchain Application, Supervision and Management (Southeast University), MoE, Nanjing 211189, Jiangsu, China +1

Graph Neural NetworksHierarchical GNNsEncrypted Network Traffic AnalysisCybersecurityMixture-of-Experts Models
AskPDF
Jun 29, 2026

Traffic-CBM: A Structurally Interpretable Multimodal Framework for Encrypted Traffic Classification

Encrypted traffic classification has achieved strong performance, but its decision process remains difficult to interpret. Existing methods usually combine flow statistics, packet sequences, and byte-level representations into opaque latent features, making it unclear which type of evidence actually drives the prediction. In this paper, we propose Traffic-CBM, a structurally interpretable multimodal framework for encrypted traffic classification. Instead of directly fusing heterogeneous traffic signals into a black-box representation, Traffic-CBM organizes them into a unified hierarchical concept space. These concepts are not manually annotated semantic attributes; rather, they are scalar evidence summaries constrained by predefined traffic evidence groups. More specifically, grouped flow statistics are mapped to statistical concepts, dedicated temporal encoders learn temporal concepts from disjoint feature subspaces, and byte-level evidence is further organized into packet-level and cross-packet concepts. This design turns heterogeneous traffic evidence into an explicit concept representation and makes different levels of traffic evidence easier to analyze. We evaluate Traffic-CBM on multiple encrypted traffic benchmarks. Results show that it achieves competitive and balanced classification performance while providing a clearer structural interpretation interface than conventional end-to-end fusion models. Further analyses suggest that the learned concept space is actively used in the prediction process and provides a clearer structural explanation of multimodal traffic evidence.

Honglei Jin, Wenshuo Chen, Shaofeng Liang +6

HKUST (GZ) Guangzhou, China · Shandong University Qingdao, China

Encrypted Network Traffic AnalysisMultimodal ClassificationMultimodal Model InterpretabilityEncrypted Traffic ClassificationMultimodal Fusion
AskPDF
May 29, 2026

GETA: Generalized Encrypted Traffic Analysis

Traditional traffic analysis is being fundamentally challenged by the rapid adoption of encryption, tunnelling, and privacy-preserving protocols, which increasingly obscure packet payloads and limit the usefulness of Deep Packet Inspection (DPI). Although machine learning has advanced encrypted traffic analysis, existing approaches often remain tied to protocol-specific header features, depend on large labelled datasets, and degrade when deployed across heterogeneous network environments. We present GETA, a protocol-agnostic framework for encrypted traffic analysis that models network flows as multivariate time series using only traffic metadata, thereby avoiding reliance on packet payloads or header semantics. GETA combines meta-learning, embedding refinement, and self-attention to support few-shot adaptation to previously unseen domains with minimal labelled data. Across nine public datasets spanning application identification, VPN traffic classification, IoT device fingerprinting, and attack detection, GETA consistently outperforms state-of-the-art baselines. These results show that GETA offers a practical and generalisable foundation for robust traffic analysis in modern encrypted networks.

Ransika Gunasekara, Rahat Masood, Salil Kanhere

University of New South Wales (UNSW)

Domain AdaptationNetwork Intrusion DetectionEncrypted Network Traffic AnalysisCybersecurityEncrypted Traffic Classification
AskPDF