Abstract: Large language models(LLMs) have demonstrated strong capabilities in complex semantic understanding.However,their application to network traffic analysis still faces several challenges,including modality discrepancies between traffic data and natural language,the complexity of feature representation,and the high cost of model training.To address these challenges,this paper proposes FlowSem-LLM(Flow Semantic Large Language Model),a TLS-encrypted traffic classification method for semantic understanding of network traffic.Without relying on domain-specific pretraining,the proposed method achieves accurate encrypted traffic classification by task-oriented fine-tuning of a general-purpose LLM.To fully exploit the characteristics of encrypted traffic,a multidimensional feature extraction scheme is designed that integrates statistical features with TLS protocol features.Specifically,statistical features are extracted from the application,transport,and network layers,while the TLS handshake process is further analyzed to obtain both handshake metadata and dynamic behavioral features.On this basis,structured traffic features are transformed into instruction-style corpora,enabling the LLM to process them in a semantic manner.Parameter-efficient supervised instruction tuning is then performed on the Llama 3.1 model using Low-Rank Adaptation(LoRA).Experimental results show that FlowSem-LLM achieves an accuracy of 0.8662 on the 120-class traffic classification task over the CSTNET-TLS1.3 dataset,demonstrating its effectiveness for protocol semantic understanding and encrypted traffic classification.

Key words: Encrypted traffic classification, Large language model, TLS encrypted traffic, Parameter-efficient fine-tuning, Network traffic analysis