Title: Mimicking Tree Structures in Traffic Analysis: A Semantic-Preserving Hierarchical Graph-Based Expert Framework for Encrypted Traffic Analysis

Abstract:

Graph-based deep learning techniques are increasingly utilized in encrypted traffic analysis to uncover latent correlations spanning various levels of granularity. Despite the high performance delivered by complex preprocessing pipelines and intricate model architectures, these approaches often obscure the inherent semantics of protocols during the representation learning phase. Additionally, the hierarchical organization of protocol layers and their associated fields—structures clearly defined by protocol specifications and commonly applied in manual traffic inspection—has received limited attention in current learning frameworks.

To address these challenges, we introduce Protocol Tree Graph Attention with Mixture of Experts (PTGAMoE), a novel framework designed for encrypted traffic analysis that preserves semantics through a hierarchical graph-based expert approach. By employing field-based graph construction and a specialized expert committee design, PTGAMoE is capable of quantifying the model’s specific preferences for particular fields and protocols.

Extensive experiments conducted on standard benchmark datasets under rigorous no-data-leakage conditions reveal that PTGAMoE significantly surpasses state-of-the-art (SOTA) models. Moreover, its semantic-preserving architecture offers interpretable insights into both protocol-level feature importance and the contributions of individual experts, thereby illuminating the model’s decision-making logic within encrypted traffic classification tasks.

Source: arXiv Generated at: 2026-06-04 00:00:00 UTC