TGLFN: 融合Transformer、GraphSAGE与Bi-LSTM的多模态加密流量分类
作者:
作者单位:

作者简介:

通讯作者:

中图分类号:

基金项目:


TGLFN: Multimodal Encrypted Traffic Classification with Transformer, GraphSAGE and Bi-LSTM
Author:
Affiliation:

Fund Project:

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
  • |
  • 文章评论
    摘要:

    随着HTTPS、VPN等加密通信的广泛应用, 传统依赖深度包检测的流量识别方法难以有效提取流量特征, 导致加密流量分类准确率下降. 针对单一特征难以充分刻画加密流量行为的问题, 本文提出一种多模态加密流量分类方法TGLFN. 该方法从字节序列、包长度序列以及图结构关系这3个维度对流量特征进行建模. 其中, 字节序列用于捕获数据包的上下文语义信息, 包长度序列用于刻画通信过程中的行为模式, 而图结构关系则用于描述流量交互特征. 通过融合3种互补特征, 能够从语义、行为和结构这3个层面全面刻画加密流量特征. 在此基础上, 引入Transformer、Bi-LSTM和GraphSAGE分别提取3类特征, 并设计跨模态融合机制实现特征交互. 本文针对多类别加密流量分类任务, 在USTC-TFC (20类)、ISCX-VPN (12类)和ISCX-Tor (16类)这3个数据集上进行实验验证. 实验结果表明, 该方法在多个公开数据集上均取得了优于现有方法的分类性能.

    Abstract:

    As encrypted communication protocols such as HTTPS and VPN become widespread, traditional traffic classification methods that rely on deep packet inspection struggle to extract traffic features effectively, resulting in lower classification accuracy for encrypted traffic. To overcome the limitations of single-feature modeling in encrypted traffic classification, this study proposes a multimodal method called TGLFN. The proposed method models traffic characteristics from three complementary perspectives: byte sequences, packet length sequences, and graph structural relationships. Specifically, byte sequences capture the contextual semantic information of packets, packet length sequences describe behavioral patterns during communication, and graph structural relationships represent interaction features within traffic flows. By integrating these complementary features, the proposed method offers a comprehensive representation of encrypted traffic in terms of semantic, behavioral, and structural aspects. Furthermore, Transformer, Bi-LSTM, and GraphSAGE are adopted to extract the corresponding features, and a cross-modal fusion mechanism is designed to enable feature interaction across modalities. This study focuses on multi-class encrypted traffic classification tasks and conducts experiments on three public datasets, namely USTC-TFC (20 classes), ISCX-VPN (12 classes), and ISCX-Tor (16 classes). Experimental results demonstrate that the proposed method achieves superior classification performance compared with existing approaches across multiple datasets.

    参考文献
    相似文献
    引证文献
引用本文

尹春勇,曹纪云. TGLFN: 融合Transformer、GraphSAGE与Bi-LSTM的多模态加密流量分类.计算机系统应用,,():1-16

复制
分享
相关视频

文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2026-04-21
  • 最后修改日期:2026-04-27
  • 录用日期:
  • 在线发布日期: 2026-08-21
  • 出版日期:
文章二维码
您是第位访问者
版权所有:中国科学院软件研究所 京ICP备05046678号-3
地址:北京市海淀区中关村南四街4号,邮政编码:100190
电话:010-62661041 传真: Email:csa@iscas.ac.cn
技术支持:北京勤云科技发展有限公司

京公网安备 11040202500063号