Abstract: In response to the challenges caused by the continuous evolution of current encryption protocols,such as the limited characterization ability of traditional single-modal detection methods and the insufficient robustness of models in highly confused environments,a multi-modal encryption traffic classification method named CMCL-ETC is proposed.This method utilizes a multi-level flow representation matrix(FLR) that retains byte logic and temporal-spatial texture,combines with fine-tuning of large language models(LLM) to extract traffic semantic features.The proposed method overcomes the limitations of single-modal detection capabilities and the difficulty in aligning heterogeneous features.A bidirectional cross-modal attention interaction mechanism and an adaptive gated fusion strategy are designed.By leveraging shared semantic space mapping and contrastive loss constraints,the byte physical distribution and semantic features of the traffic are aligned and complemented.Experimental results on two encryption traffic datasets,CSTNET-TLS 1.3 and CipherSpectrum,demonstrate that the accuracy of CMCL-ETC reaches 93.65% and 97.33% respectively under full data,outperforming current advanced benchmark models.The experiments confirm that by introducing LLM and cross-modal interaction mechanisms,the performance of large-scale encryption traffic classification tasks can be improved.

Key words: Encrypted traffic classification, Large language models, Multimodal fusion, Contrastive learning, Cybersecurity