TrafficMoE: Heterogeneity-aware Mixture of Experts for Encrypted Traffic Classification

Qing He; Xiaowei Fu; Lei Zhang

cs.CRMar 31, 2026

TrafficMoE: Heterogeneity-aware Mixture of Experts for Encrypted Traffic Classification

Authors: Qing He, Xiaowei Fu, Lei Zhang

Organizations: School of Microelectronics and Communication Engineering, Chongqing University, Chongqing 400044, China.

Abstract

Encrypted traffic classification is a critical task for network security. While deep learning has advanced this field, the occlusion of payload semantics by encryption severely challenges standard modeling approaches. Most existing frameworks rely on static and homogeneous pipelines that apply uniform parameter sharing and static fusion strategies across all inputs. This one-size-fits-all static design is inherently flawed: by forcing structured headers and randomized payloads into a unified processing pipeline, it inevitably entangles the raw protocol signals with stochastic encryption noise, thereby degrading the fine-grained discriminative features. In this paper, we propose TrafficMoE, a framework that breaks through the bottleneck of static modeling by establishing a Disentangle-Filter-Aggregate (DFA) paradigm. Specifically, to resolve the structural between-components conflict, the architecture disentangles headers and payloads using dual-branch sparse Mixture-of-Experts (MoE), enabling modality-specific modeling. To mitigate the impact of stochastic noise, an uncertainty-aware filtering mechanism is introduced to quantify reliability and selectively suppress high-variance representations. Finally, to overcome the limitations of static fusion, a routing-guided strategy aggregates cross-modality features dynamically, that adaptively weighs contributions based on traffic context. With this DFA paradigm, TrafficMoE maximizes representational efficiency by focusing solely on the most discriminative traffic features. Extensive experiments on six datasets demonstrate TrafficMoE consistently outperforms state-of-the-art methods, validating the necessity of heterogeneity-aware modeling in encrypted traffic analysis. The source code is publicly available at https://github.com/Posuly/TrafficMoE_main.

Figures & tables

Panel of Figure 1 — Fig. 1: Comparison between existing modeling paradigms and the proposed TrafficMoE framework. Existing paradigm (a) typically process heterogeneous traffic components in a unified manner with static fusion strategies, whereas TrafficMoE (b) explicitly disentangles headers and payloads, incorporates uncertainty-aware filtering (UF), and performs conditional aggregation (CA) guided by MoE routing probabilities for adaptive and context-aware integration.

Fig. 2: Overview of the TrafficMoE framework. The dual-branch MoE architecture explicitly models heterogeneous traffic components, i.e., the Header and Payload branches, which can capture intra-modality patterns, respectively. The uncertainty-aware filter suppresses unreliable tokens, i.e., noisy traffic components, and the conditional aggregation module fuses the final purified features across two modalities (header vs. payload) in a routing-guided manner for encrypted traffic classification.

Fig. 3: End-to-end preprocessing pipeline for encrypted traffic. Raw traffic is first segmented into flows using canonical 5-tuple session identification. These flows are further decomposed into packet-level units through packets splitting. Each packet undergoes byte-level cropping and zero-padding to produce fixed-dimensional header and payload segments. The resulting sequence of fixed packets is then partitioned into non-overlapping strides, enabling consistent, length-normalized inputs for subsequent neural processing while preserving temporal ordering and structural heterogeneity.

Panel of Figure 4 — Fig. 4: The basic idea of UF, which quantifies the alignment uncertainty via Shannon entropy ( $H$ ). Sharp distributions in green mean low entropy $H$ and identify reliable metadata to be retained (i.e., the filter $g\to 1$ ), while dispersed distributions in red mean high entropy $H$ and identify noisy components to be suppressed (i.e., the filter $g\to 0$ ).

Fig. 5: Training pipeline of the proposed framework. In the pre-training stage, masked language modeling (MLM) is used to learn contextual representations from header and payload sequences without supervision. In the fine-tuning stage, the pretrained encoders are fine-tuned end-to-end on labeled traffic data through a standard cross-entropy classification objective.

Dataset	# Sample	# Category
CSTNET-TLS 1.3	46,356	120
ISCX-Tor2016	14,569	16
CIC-IoT2022	22,634	6
USTC-TFC2016	50,677	20
ISCX-VPN (APP)	2,329	12
ISCX-VPN (Service)	3,694	17

TABLE I: Statistical Information of Fine-tuning Datasets

Dataset	ISCX-Tor2016				CSTNET-TLS				CIC-IoT2022
Metric	AC	PR	RC	F1	AC	PR	RC	F1	AC	PR	RC	F1
AppScanner [ 33 ]	0.9075	0.7728	0.8033	0.7848	0.7441	0.7232	0.6963	0.7023	0.8591	0.8858	0.7996	0.8288
BIND [ 34 ]	0.9010	0.8582	0.8354	0.8439	0.4710	0.4315	0.4226	0.4189	0.7349	0.6754	0.6387	0.6435
CUMUL [ 35 ]	0.7725	0.6463	0.6443	0.6401	0.5921	0.5528	0.5604	0.5493	0.7019	0.6746	0.7029	0.6687
DF [ 36 ]	0.7401	0.5918	0.5611	0.5492	0.5729	0.5398	0.5144	0.4933	0.2746	0.2140	0.1870	0.1647
FSNet [ 13 ]	0.6967	0.6159	0.6061	0.6028	0.7814	0.7670	0.7316	0.7311	0.8077	0.8250	0.8333	0.7804

TABLE II: Comparison results on ISCX-Tor2016, CSTNET-TLS, and CIC-IoT2022 datasets.

Dataset	USTC-TFC				ISCX-VPN (APP)				ISCX-VPN (Service)
Metric	AC	PR	RC	F1	AC	PR	RC	F1	AC	PR	RC	F1
AppScanner [ 33 ]	0.8585	0.9108	0.9034	0.8976	0.7945	0.6950	0.6975	0.6874	0.8681	0.8710	0.8435	0.8546
BIND [ 34 ]	0.7945	0.7811	0.7061	0.7115	0.6951	0.6266	0.5415	0.5609	0.8345	0.7769	0.7714	0.7699
CUMUL [ 35 ]	0.7173	0.5063	0.5812	0.5183	0.5480	0.4839	0.4615	0.4554	0.7099	0.6959	0.6893	0.6884
DF [ 36 ]	0.6452	0.4019	0.3685	0.3059	0.4935	0.2449	0.2592	0.2289	0.5018	0.4664	0.4773	0.3934
FSNet [ 13 ]	0.7558	0.8167	0.8407	0.8042	0.6316	0.4899	0.4833	0.4677	0.9087	0.9051	0.9054	0.9051

TABLE III: Comparison results on USTC-TFC, ISCX-VPN (APP), and ISCX-VPN (Service) datasets.

Method	Accuracy (%)	F1 (%)
Heterogeneous MoE (Full)	97.65	97.65
Homogeneous MoE	92.21	92.32
Header-only	75.65	75.65
Payload-only	45.12	45.22

TABLE IV: Ablation on Heterogeneous MoE Structure.

Panel of Figure 10 — Fig. 6: Impact of the expert number in MoE for Header branch, Payload branch and the Global module, respectively, on ISCX-Tor2016 and CSTNET-TLS datasets. Clearly, MoE further improves representations.

Method	Accuracy (%)	F1 (%)
TrafficMoE	97.65	97.65
w/o UF	95.69	95.69
w/o CA	96.33	96.33
w/o Cross-Modal Interaction	96.87	96.87
w/o Pre-training	73.25	73.25

TABLE V: Ablation study of the TrafficMoE. Accuracy and F1-score are reported under different filtering configurations.

Panel of Figure 12 — Fig. 7: Class-wise expert behavior analysis of TrafficMoE. The average expert activation for each traffic class at the early training stage (Epoch 0) and converged stage (Epoch 120) is visualized, respectively. As training progresses, the routing distributions evolve from dispersed and class-agnostic patterns to structured and class-specific activations, indicating the expert specialization is aligned with semantic traffic categories.

Panel of Figure 13 — Fig. 8: Visualization of UF module before and after filtering. The heatmaps illustrate the relative feature magnitude of interleaved packet sequences across different traffic samples. The red dashed lines delineate the boundaries between individual network packets, while the white dotted lines separate the header and payload segments within each packet. After filtering, UF drastically suppresses the noisy components with high-energy activations in encrypted payload segments.

Encrypted Traffic Classification

See all 15 papers

Treat Traffic Like Trees: A Semantic-Preserving Hierarchical Graph-Based Expert Framework for Encrypted Traffic Analysis
Jun 3, 2026Yuantu Luo, Jun Tao, Linxiao Yu +1Graph Neural Networks Hierarchical GNNs
School of Cyber Science and Engineering, Southeast University, Nanjing 211189, China · Purple Mountain Laboratories, Nanjing 210096, China · Engineering Research Center of Blockchain Application, Supervision and Management (Southeast University), MoE, Nanjing 211189, Jiangsu, China +1
Traffic-CBM: A Structurally Interpretable Multimodal Framework for Encrypted Traffic Classification
Jun 29, 2026Honglei Jin, Wenshuo Chen, Shaofeng Liang +6Encrypted Network Traffic Analysis Multimodal Classification
HKUST (GZ) Guangzhou, China · Shandong University Qingdao, China
GETA: Generalized Encrypted Traffic Analysis
May 29, 2026Ransika Gunasekara, Rahat Masood, Salil KanhereDomain Adaptation Network Intrusion Detection
University of New South Wales (UNSW)

Jun 3, 2026J/K move · Enter open · S save

Treat Traffic Like Trees: A Semantic-Preserving Hierarchical Graph-Based Expert Framework for Encrypted Traffic Analysis

Yuantu Luo, Jun Tao, Linxiao Yu, Guang Cheng

School of Cyber Science and Engineering, Southeast University, Nanjing 211189, China · Purple Mountain Laboratories, Nanjing 210096, China · Engineering Research Center of Blockchain Application, Supervision and Management (Southeast University), MoE, Nanjing 211189, Jiangsu, China+1

Graph Neural Networks Hierarchical GNNs Encrypted Network Traffic Analysis Cybersecurity Mixture-of-Experts Models

Open paper AskPDF arXiv

Graph-based deep learning methods have been widely employed in encrypted traffic analysis to exploit latent correlations across different granularities. However, while complex preprocessing pipelines and sophisticated model structures often achieve strong performance, they may obscure inherent protocol semantics during representation learning. Moreover, the hierarchical structure of protocol layers and their corresponding fields, defined by protocol specifications and routinely utilized in manual traffic analysis, remains underexplored in existing learning frameworks. In this paper, we propose Protocol Tree Graph Attention with Mixture of Experts (PTGAMoE), a semantic-preserving hierarchical graph-based expert framework for encrypted traffic analysis. The field-based graph construction and expert committee design enable PTGAMoE to quantify the model's preferences for specific fields and protocols. Extensive experimental results on representative benchmark datasets under strict no-data-leakage settings demonstrate that PTGAMoE significantly outperforms state-of-the-art (SOTA) models. Furthermore, the semantic-preserving design provides interpretable insights into protocol-level feature importance and expert-level contributions, reflecting the model's decision-making logic in encrypted traffic classification tasks.

Abstract

Encrypted Traffic Classification

Explore similar work

Treat Traffic Like Trees: A Semantic-Preserving Hierarchical Graph-Based Expert Framework for Encrypted Traffic Analysis

Traffic-CBM: A Structurally Interpretable Multimodal Framework for Encrypted Traffic Classification

GETA: Generalized Encrypted Traffic Analysis