Abstract:As encrypted communication protocols such as HTTPS and VPN become widespread, traditional traffic classification methods that rely on deep packet inspection struggle to extract traffic features effectively, resulting in lower classification accuracy for encrypted traffic. To overcome the limitations of single-feature modeling in encrypted traffic classification, this study proposes a multimodal method called TGLFN. The proposed method models traffic characteristics from three complementary perspectives: byte sequences, packet length sequences, and graph structural relationships. Specifically, byte sequences capture the contextual semantic information of packets, packet length sequences describe behavioral patterns during communication, and graph structural relationships represent interaction features within traffic flows. By integrating these complementary features, the proposed method offers a comprehensive representation of encrypted traffic in terms of semantic, behavioral, and structural aspects. Furthermore, Transformer, Bi-LSTM, and GraphSAGE are adopted to extract the corresponding features, and a cross-modal fusion mechanism is designed to enable feature interaction across modalities. This study focuses on multi-class encrypted traffic classification tasks and conducts experiments on three public datasets, namely USTC-TFC (20 classes), ISCX-VPN (12 classes), and ISCX-Tor (16 classes). Experimental results demonstrate that the proposed method achieves superior classification performance compared with existing approaches across multiple datasets.