计算机科学

计算机科学 ›› 2026, Vol. 53 ›› Issue (10): 92-101.doi: 10.11896/jsjkx.260300110

• 大模型与多模态智能感知 • 上一篇    下一篇

基于跨模态对比学习的加密流量分类研究

曹扬1, 李鹏1,2, 陈树翰1, 莫永梅1   

  1. 1 南京邮电大学计算机学院 南京 210023
    2 南京邮电大学网络安全与可信计算研究所 南京 210023
  • 收稿日期:2026-03-23 修回日期:2026-07-15 发布日期:2026-10-13
  • 通讯作者: 李鹏(lipeng@njupt.edu.cn)
  • 作者简介:(1224045406@njupt.edu.cn)
  • 基金资助:
    江苏省六大人才高峰高层次人才项目(RJFW-111);江苏省研究生科研与实践创新计划(KYCX23_1048)

Cross-modal Contrastive Learning for Encrypted Traffic Classification

CAO Yang1, LI Peng1,2, CHEN Shuhan1, MO Yongmei1   

  1. 1 School of Computer Science,Nanjing University of Posts and Telecommunications,Nanjing 210023, China
    2 Institute of Network Security and Trusted Computing,Nanjing University of Posts and Telecommunications,Nanjing 210023, China
  • Received:2026-03-23 Revised:2026-07-15 Online:2026-10-13
  • About author:CAO Yang,born in 2002,postgraduate.His main research interests include encryption traffic analysis and large language model.
    LI Peng,born in 1979,Ph.D,professor,Ph.D supervisor,is a member of CCF(No.48573M).His main research interests include computer communication networks,cloud computing and information security.
  • Supported by:
    Six Talent Peaks Project of Jiangsu Province(RJFW-111) and Postgraduate Research and Practice Innovation Program of Jiangsu Province(KYCX23_1048).

PDF (PC)

79

摘要： 针对当前加密协议不断演进导致传统单模态检测方法表征能力受限、模型在高度混淆环境下鲁棒性不足等挑战,通过构建保留字节逻辑与时空纹理的多级流表示矩阵(FLR),并结合微调大语言模型(LLM)提取流量语义特征,提出了一种基于跨模态对比学习的多模态加密流量分类方法 CMCL-ETC。该方法解决了单模态检测能力不足、异构特征对齐困难等问题。具体地,设计了双向跨模态注意力交互机制与自适应门控融合策略,利用共享语义空间映射与对比损失约束,实现了流量的字节物理分布与语义特征的对齐互补。在CSTNET-TLS 1.3 和CipherSpectrum两个加密流量数据集上的实验结果表明,CMCL-ETC在全量数据下的准确率分别达到93.65%和97.33%,均优于当前先进的基准模型。实验证实,通过引入LLM与跨模态交互机制,能够提升大规模加密流量分类任务的性能。

关键词: 加密流量分类, 大语言模型, 多模态融合, 对比学习, 网络安全

Abstract: In response to the challenges caused by the continuous evolution of current encryption protocols,such as the limited characterization ability of traditional single-modal detection methods and the insufficient robustness of models in highly confused environments,a multi-modal encryption traffic classification method named CMCL-ETC is proposed.This method utilizes a multi-level flow representation matrix(FLR) that retains byte logic and temporal-spatial texture,combines with fine-tuning of large language models(LLM) to extract traffic semantic features.The proposed method overcomes the limitations of single-modal detection capabilities and the difficulty in aligning heterogeneous features.A bidirectional cross-modal attention interaction mechanism and an adaptive gated fusion strategy are designed.By leveraging shared semantic space mapping and contrastive loss constraints,the byte physical distribution and semantic features of the traffic are aligned and complemented.Experimental results on two encryption traffic datasets,CSTNET-TLS 1.3 and CipherSpectrum,demonstrate that the accuracy of CMCL-ETC reaches 93.65% and 97.33% respectively under full data,outperforming current advanced benchmark models.The experiments confirm that by introducing LLM and cross-modal interaction mechanisms,the performance of large-scale encryption traffic classification tasks can be improved.

Key words: Encrypted traffic classification, Large language models, Multimodal fusion, Contrastive learning, Cybersecurity

中图分类号: 

  • TP393.08
[1] AKBARI I,SALAHUDDIN M A,ANIVA L,et al.Traffic classification in an increasingly encrypted web[J].Communications of the ACM,2022,65(10):75-83.
[2] CHEN Z H,CHENG G,XU Z H,et al.A Survey on Internet Encrypted Traffic Detection,Classification and Identification[J].Chinese Journal of Computers,2023,46(5):1060-1085.
[3] HOU J,LU H,LIU F A,et al.Detection and Counter-measureof Encrypted Malicious Traffic:A Survey[J].Journal of Software,2024,35(1):333-355.
[4] VAN EDE T,BORTOLAMEOTTI R,CONTINELLA A,et al.FlowPrint:Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic[C]//Proceedings 2020 Network and Distributed System Security Symposium.San Diego,CA:Internet Society,2020.
[5] PANCHENKO A,LANZE F,ZINNEN A,et al.Website Fin-gerprinting at Internet Scale[C]//Proceedings 2016 Network and Distributed System Security Symposium.San Diego,CA:Internet Society,2016.
[6] TAYLOR V F,SPOLAOR R,CONTI M,et al.AppScanner:Automatic Fingerprinting of Smartphone Apps from Encrypted Network Traffic[C]//2016 IEEE European Symposium on Security and Privacy(EuroS&P).IEEE,2016:439-454.
[7] LOTFOLLAHI M,JAFARI SIAVOSHANI M,SHIRALIHOSSEIN ZADE R,et al.Deep packet:a novel approach for encrypted traffic classification using deep learning[J].Soft Computing,2020,24(3):1999-2012.
[8] ZHOU H,HU C,YUAN Y,et al.Large Language Model(LLM) for Telecommunications:A Comprehensive Survey on Principles,Key Techniques,and Opportunities[J].IEEE Communications Surveys & Tutorials,2025,27(3):1955-2005.
[9] SHEN M,JI K,GAO Z,et al.Subverting Website Fingerprin-ting Defenses with Robust Traffic Representation[C]//32nd USENIX Security Symposium(USENIX Security 23).2023:607-624.
[10] WANG W,ZHU M,ZENG X W,et al.Malware traffic classification using convolutional neural network for representation learning[C]//2017 International Conference on Information Networking(ICOIN).IEEE,2017:712-717.
[11] NGUYEN T T T,ARMITAGE G.A survey of techniques for internet traffic classification using machine learning[J].IEEE Communications Surveys & Tutorials,2008,10(4):56-76.
[12] CAI Z,JIANG B,LU Z,et al.isAnon:Flow-Based Anonymity Network Traffic Identification Using Extreme Gradient Boosting[C]//2019 International Joint Conference on Neural Networks(IJCNN).2019:1-8.
[13] AL-NAAMI K,CHANDRA S,MUSTAFA A,et al.Adaptiveencrypted traffic fingerprinting with bi-directional dependence[C]//Proceedings of the 32nd Annual Conference on Computer Security Applications.ACM,2016:177-188.
[14] LIU C,HE L,XIONG G,et al.FS-Net:A Flow Sequence Network For Encrypted Traffic Classification[C]//IEEE INFOCOM 2019－IEEE Conference on Computer Communications.IEEE,2019:1171-1179.
[15] LIN K,XU X,GAO H.TSCRNN:A novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of IIoT[J].Computer Networks,2021,190:107974.
[16] ZHANG H,YU L,XIAO X,et al.TFE-GNN:A Temporal Fusion Encoder Using Graph Neural Networks for Fine-grained Encrypted Traffic Classification[C]//Proceedings of the ACM Web Conference 2023.New York:ACM,2023:2066-2075.
[17] ZHANG H,YUE H,XIAO X,et al.Revolutionizing Encrypted Traffic Classification with MH-Net:A Multi-View Heterogeneous Graph Model[C]//Proceedings of the AAAI Conference on Artificial Intelligence.2025:1048-1056.
[18] LIN X,XIONG G,GOU G,et al.ET-BERT:A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification[C]//Proceedings of the ACM Web Conference 2022.New York:ACM,2022:633-642.
[19] ZHAO R,ZHAN M,DENG X,et al.Yet Another Traffic Classifier:A Masked Autoencoder Based Traffic Transformer with Multi-Level Flow Representation[C]//Proceedings of the AAAI Conference on Artificial Intelligence.2023:5420-5427.
[20] ZHOU G,GUO X,LIU Z,et al.TrafficFormer:An EfficientPre-trained Model for Traffic Data[C]//2025 IEEE Symposium on Security and Privacy(SP).2025:1844-1860.
[21] GINIGE Y,DAHANAYAKA T,SENEVIRATNE S.Traffic-GPT:An LLM Approach for Open-Set Encrypted Traffic Classification[C]//Proceedings of the Asian Internet Engineering Conference 2024.New York:ACM,2024:26-35.
[22] CUI T,LIN X,LI S,et al.TrafficLLM:Enhancing Large Language Models for Network Traffic Analysis with Generic Traffic Representation[PP/OL].arXiv [2026-08-05].https://arxiv.org/abs/2504.04222.
[23] ZHANG Y,ZHANG R,ZHANG J,et al.LlamaFactory:Unified Efficient Fine-Tuning of 100+ Language Models[PP/OL].ar-Xiv [2026-08-05].https://arxiv.org/abs/2403.13372.
[24] ZHU J,WANG W,CHEN Z,et al.InternVL3:Exploring Advanced Training and Test-Time Recipes for Open-Source Multimodal Models[PP/OL].arXiv [2026-08-05].https://arxiv.org/abs/2504.10479.
[25] HOU Q,ZHOU D,FENG J.Coordinate Attention for EfficientMobile Network Design[C]//2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition(CVPR).2021:13708-13717.
[26] WICKRAMASINGHE N,SHAGHAGHI A,TSUDIK G,et al.SoK:Decoding the Enigma of Encrypted Network Traffic Classifiers[C]//2025 IEEE Symposium on Security and Privacy(SP).2025:1825-1843.
Viewed
Full text


Abstract

Cited
  Shared   
  Discussed   
No Suggested Reading articles found!
渝ICP备16013121号-4
地址：重庆市两江新区洪湖西路18号    邮编：401121  
电话：023-63500828（编辑部） 023-67039612（会议/专题） 023-67039623（财务/发票）
E-mail：jsjkx12@163.com
本系统由北京玛格泰克科技发展有限公司设计开发