Search papers, labs, and topics across Lattice.
This paper introduces TDDM-Melatt, a novel framework for encrypted traffic classification that combines a memory-decoupled representation model with a tailored Traffic Denoising Diffusion Model (TDDM). By addressing issues of spurious feature correlations and sample imbalance through a strict pre-training paradigm and efficient inference mechanism, the framework significantly enhances generalization to real-world traffic scenarios. Experimental results demonstrate that TDDM-Melatt surpasses six baseline classification models and six state-of-the-art representation learning models across four benchmark datasets.
TDDM-Melatt achieves superior encrypted traffic classification by effectively eliminating spurious correlations and enhancing generalization, outperforming existing models.
The widespread adoption of encrypted traffic poses severe challenges to current security situational awareness systems based on network traffic monitoring. In existing dataset-driven training and testing studies, limitations such as shortcut learning induced by spurious feature correlations and sample imbalance caused by the long-tail distribution of real-world traffic result in weak generalization of traffic identification performance to real-world network traffic. To address these limitations, we propose TDDM-Melatt, a disentangled memory-based traffic classification framework with diffusion-based data augmentation. First, we design Melatt, a memory-decoupled traffic representation model, which employs Competitive Gating Long Short-Term Memory (CG-LSTM) to construct the encoder and decoder. We design a spurious-correlation-free pre-training and inference paradigm, employing strict topology anonymization and a frozen pre-trained encoder strategy to cut off the model's learning pathways for spurious features. During inference, classification is performed efficiently by a downstream classifier on the frozen representations. Second, we propose a Traffic Denoising Diffusion Model (TDDM) tailored to the characteristics of traffic data. Extensive experiments are conducted on 4 representative public benchmark datasets. Under strict flow-level splitting and anonymization, TDDM-Melatt outperforms 6 basic classification models and 6 SOTA representation learning models. The proposed method provides a new and effective technical pathway for encrypted traffic classification in real-world network environments.
