计算机科学

计算机科学 ›› 2026, Vol. 53 ›› Issue (10): 113-122.doi: 10.11896/jsjkx.260300072

• 大模型与多模态智能感知 • 上一篇    下一篇

FlowSem-LLM:面向流量语义理解的TLS加密流量分类方法

陈树翰1, 李鹏1,2   

  1. 1 南京邮电大学计算机学院 南京 210023
    2 南京邮电大学网络安全与可信计算研究所 南京 210023
  • 收稿日期:2026-03-16 修回日期:2026-06-24 发布日期:2026-10-13
  • 通讯作者: 李鹏(lipeng@njupt.edu.cn)
  • 作者简介:(2025040330@njupt.edu.cn)
  • 基金资助:
    江苏省六大人才高峰高层次人才项目(RJFW-111);江苏省研究生科研与实践创新计划(KYCX23_1048)

FlowSem-LLM:TLS Encrypted Traffic Classification Method for Flow Semantic Understanding

CHEN Shuhan1, LI Peng1,2   

  1. 1 College of Computer Science,Nanjing University of Posts and Telecommunications,Nanjing 210023, China
    2 Institute of Network Security and Trusted Computing,Nanjing University of Posts and Telecommunications,Nanjing 210023, China
  • Received:2026-03-16 Revised:2026-06-24 Online:2026-10-13
  • About author:CHEN Shuhan,born in 2002,Ph.D candidate.His main research interests include network traffic classification and large language models.
    LI Peng,born in 1979,Ph.D,professor,Ph.D supervisor,is a member of CCF(No.48573M).His main research interests include computer communication networks,cloud computing and information security.
  • Supported by:
    Six Talent Peaks Project of Jiangsu Province(RJFW-111) and Postgraduate Research and Practice Innovation Program of Jiangsu Province(KYCX23_1048).

PDF (PC)

65

摘要： 大语言模型在复杂语义理解方面表现出强大的能力,但由于数据模态差异、特征表达复杂性及高昂的训练成本,其在网络流量领域的应用面临着诸多挑战。为应对上述挑战,提出了FlowSem-LLM(Flow Semantic Large Language Mo-del)——一种面向网络流量语义理解的TLS加密流量分类方法。在无需特定领域预训练的条件下,该方法通过对通用大语言模型进行任务定向微调,实现对加密流量的精准分类。为充分挖掘加密流量特征,设计了一种融合统计特征与TLS协议特征的多维度特征提取方法,分别在应用层、传输层与网络层提取统计特征,并深入解析TLS握手过程,提取协议握手元特征与动态行为特征。在此基础上,将结构化的流量特征转化为指令式语料,使其能够以语义化形式输入大语言模型,并采用参数高效微调的低秩自适应方法对Llama 3.1模型进行指令式监督微调。实验结果表明,FlowSem-LLM在CSTNET-TLS1.3数据集上的120类流量分类任务中取得了0.8662的准确率,验证了该方法在协议语义理解与加密流量分类任务中的有效性。

关键词: 加密流量分类, 大语言模型, TLS加密流量, 参数高效微调, 网络流量分析

Abstract: Large language models(LLMs) have demonstrated strong capabilities in complex semantic understanding.However,their application to network traffic analysis still faces several challenges,including modality discrepancies between traffic data and natural language,the complexity of feature representation,and the high cost of model training.To address these challenges,this paper proposes FlowSem-LLM(Flow Semantic Large Language Model),a TLS-encrypted traffic classification method for semantic understanding of network traffic.Without relying on domain-specific pretraining,the proposed method achieves accurate encrypted traffic classification by task-oriented fine-tuning of a general-purpose LLM.To fully exploit the characteristics of encrypted traffic,a multidimensional feature extraction scheme is designed that integrates statistical features with TLS protocol features.Specifically,statistical features are extracted from the application,transport,and network layers,while the TLS handshake process is further analyzed to obtain both handshake metadata and dynamic behavioral features.On this basis,structured traffic features are transformed into instruction-style corpora,enabling the LLM to process them in a semantic manner.Parameter-efficient supervised instruction tuning is then performed on the Llama 3.1 model using Low-Rank Adaptation(LoRA).Experimental results show that FlowSem-LLM achieves an accuracy of 0.8662 on the 120-class traffic classification task over the CSTNET-TLS1.3 dataset,demonstrating its effectiveness for protocol semantic understanding and encrypted traffic classification.

Key words: Encrypted traffic classification, Large language model, TLS encrypted traffic, Parameter-efficient fine-tuning, Network traffic analysis

中图分类号: 

  • TP393.08
[1] WICKRAMASINGHE N,SHAGHAGHI A,TSUDIK G,et al.SoK:Decoding the Enigma of Encrypted Network Traffic Classifiers[C]//2025 IEEE Symposium on Security and Privacy(SP).IEEE,2025:1825-1843.
[2] CHEN Z H,CHENG G,XU Z H,et al.A Survey on Internet Encrypted Traffic Detection,Classification and Identification [J].Chinese Journal of Computers,2023,46(5):1060-1085.
[3] HOU J,LU H,LIU F A,et al.Detection and Countermeasure of Encrypted Malicious Traffic:A Survey [J].Journal of Software,2024,35(1):333-355.
[4] PAPADOGIANNAKI E,IOANNIDIS S.A Survey on Encrypted Network Traffic Analysis Applications,Techniques,and Countermeasures [J].ACM Computing Surveys,2021,54(6):1-35.
[5] YU F,CHEN Z F,DIAO Y L,et al.Fast and Memory-Efficient Regular Expression Matching for Deep Packet Inspection[C]//Proceedings of the 2006 ACM/IEEE Symposium on Architecture for Networking and Communications Systems.ACM,2006:93-102.
[6] WANG Z H,FOK K W,THING V L L.Machine learning forencrypted malicious traffic detection:Approaches,datasets and comparative study [J].Computers & Security,2022,113:102542.
[7] ACETO G,CIUONZO D,MONTIERI A,et al.Mobile encrypted traffic classification using deep learning:Experimental evaluation,lessons learned,and challenges [J].IEEE Transactions on Network and Service Management,2019,16(2):445-458.
[8] CHEN L C,GAO S,LIU B X,et al.Research Status and Development Trends on Network Encrypted Traffic Identification [J].Netinfo Security,2019,19(3):19-25.
[9] MOORE A W,ZUEV D.Internet Traffic Classification UsingBayesian Analysis Techniques[C]//Proceedings of the 2005 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems.New York:ACM,2005:50-60.
[10] DONG S,LI R X.Traffic identification method based on multiple probabilistic neural network model [J].Neural Computing and Applications,2019,31(2):473-487.
[11] VAN EDE T,BORTOLAMEOTTI R,CONTINELLA A,et al.FlowPrint:Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic[C]//Network and Distributed System Security Symposium(NDSS).San Diego:Internet Society,2020.
[12] JIANG T T,YIN W X,CAI B,et al.Encrypted Malicious Traffic Identification Based on Hierarchical Spatiotemporal Feature and Multi-Head Attention [J].Computer Engineering,2021,47(7):101-108.
[13] CHEN M H,ZHU Y F,LU B,et al.Classification of Application Type of Encrypted Traffic Based on Attention-CNN [J].Computer Science,2021,48(4):325-332.
[14] SHEN M,ZHANG J P,ZHU L H,et al.Accurate decentralized application identification via encrypted traffic analysis using graph neural networks [J].IEEE Transactions on Information Forensics and Security,2021,16:2367-2380.
[15] CUI S,HAN X Y,HAN D Q,et al.FG-SAT:Efficient FlowGraph for Encrypted Traffic Classification Under Environment Shifts [J].IEEE Transactions on Information Forensics and Security,2025,20:5326-5339.
[16] DONG S,XIA Y J,PENG T.Traffic identification model based on generative adversarial deep convolutional network [J].Annals of Telecommunications,2022,77(9):573-587.
[17] BU Z Y,ZHOU B,CHENG P Y,et al.Encrypted network traffic classification using deep and parallel network-in-network models [J].IEEE Access,2020,8:132950-132959.
[18] ACETO G,CIUONZO D,MONTIERI A,et al.MIMETIC:Mobile encrypted traffic classification using multimodal deep lear-ning [J].Computer Networks,2019,165:106944.
[19] REZAEI S,LIU X.Deep Learning for Encrypted TrafficClassification:An Overview [J].IEEE Communications Magazine,2019,57(5):76-81.
[20] WANG Z X,LI Z Y,FU M Y,et al.Network traffic classification based on federated semi-supervised learning [J].Journal of Systems Architecture,2024,149:103091.
[21] MA Y X,LI Z D,XUE H M,et al.A balanced supervised contrastive learning-based method for encrypted network traffic classification [J].Computers & Security,2024,145:104023.
[22] DONG S,XIA Y J,PENG T.Network abnormal traffic detection model based on semi-supervised deep reinforcement learning [J].IEEE Transactions on Network and Service Management,2021,18(4):4197-4212.
[23] LIN X J,XIONG G,GOU G P,et al.ET-BERT:A Contextualized Datagram Representation with Pre-Training Transformers for Encrypted Traffic Classification[C]//Proceedings of the ACM Web Conference 2022.New York:ACM,2022:633-642.
[24] HE H Y,YANG Z G,CHEN X N.PERT:Payload Encoding Representation from Transformer for Encrypted Traffic Classification[C]//Proceedings of the 2020 ITU Kaleidoscope:Industry-Driven Digital Transformation.IEEE,2020:1-8.
[25] LIANG Y,LI P C,LAI Q N,et al.EM-BERT:A LanguageModel-Based Method to Detect Encrypted Malicious Network Traffic[C]//Proceedings of International Conference on Image,Vision and Intelligent Systems 2023(ICIVIS 2023).Singapore:Springer,2024:580-589.
[26] ZHOU G M,GUO X W,LIU Z T,et al.TrafficFormer:An Efficient Pre-Trained Model for Traffic Data[C]//2025 IEEE Symposium on Security and Privacy(SP).IEEE,2025:1844-1860.
[27] MENG X Y,LIN C G,WANG Y Q,et al.NetGPT:Generative pretrained transformer for network traffic [J].arXiv:2304.09513,2023.
[28] CUI T,LIN X,LI S,et al.TrafficLLM:Enhancing large lan-guage models for network traffic analysis with generic traffic representation [J].arXiv:2504.04222,2025.
[29] WU D,WANG X D,QIAO Y Q,et al.NetLLM:Adapting Large Language Models for Networking[C]//Proceedings of the ACM SIGCOMM 2024 Conference.New York:ACM,2024:661-678.
[30] LIN K D,XU X L,XIAO F.MFFusion:A multi-level features fusion model for malicious traffic detection based on deep lear-ning [J].Computer Networks,2022,202:108658.
[31] LIN P,YE K J,HU Y S,et al.A novel multimodal deep learning framework for encrypted traffic classification [J].IEEE/ACM Transactions on Networking,2022,31(3):1369-1384.
[32] YU L X,TAO J,XU Y F,et al.TLS fingerprint for encrypted malicious traffic detection with attributed graph kernel [J].Computer Networks,2024,247:110475.
[33] LEE H W,KIM D W,KWON Y H.TLS 1.3 in Practice:HowTLS 1.3 Contributes to the Internet[C]//Proceedings of the Web Conference 2021.New York:ACM,2021:70-79.
[34] CHEN J F,SONG L,CAI S H,et al.TLS-MHSA:An efficient detection model for encrypted malicious traffic based on multi-head self-attention mechanism [J].ACM Transactions on Privacy and Security,2023,26(4):1-21.
[35] MA X L,ZHU W B,WEI J L,et al.EETC:An extended en-crypted traffic classification algorithm based on variantResNet network [J].Computers & Security,2023,128:103175.
[36] AL-NAAMI K,CHANDRA S,MUSTAFA A,et al.AdaptiveEncrypted Traffic Fingerprinting with Bi-Directional Depen-dence[C]//Proceedings of the 32nd Annual Conference on Computer Security Applications(ACSAC ’16).New York:ACM,2016:177-188.
[37] SIRINAM P,IMANI M,JUAREZ M,et al.Deep Fingerprin-ting:Undermining Website Fingerprinting Defenses with Deep Learning[C]//Proceedings of the 2018 ACM SIGSAC Confe-rence on Computer and Communications Security.New York:ACM,2018:1928-1943.
[38] ZHENG Y W,ZHANG R C,ZHANG J H,et al.LlamaFactory:Unified Efficient Fine-Tuning of 100+ Language Models[C]//Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics.ACL,2024:400-410.
Viewed
Full text


Abstract

Cited
  Shared   
  Discussed   
No Suggested Reading articles found!
渝ICP备16013121号-4
地址：重庆市两江新区洪湖西路18号    邮编：401121  
电话：023-63500828（编辑部） 023-67039612（会议/专题） 023-67039623（财务/发票）
E-mail：jsjkx12@163.com
本系统由北京玛格泰克科技发展有限公司设计开发