FG-SAT: Efficient Flow Graph for Encrypted Traffic Classification under Environment Shifts

TL;DR

FG-SAT presents a flow-centric, graph-based approach to encrypted traffic classification that remains robust under environment shifts. By encoding per-flow packets as Flow Graphs and applying a Jensen-Shannon divergence-based feature selection, the method isolates stable header features to feed a GraphSAGE-GAT classifier (GraphSAT). Empirical results on attack detection and application classification show FG-SAT delivering higher accuracy and lower inference time than state-of-the-art baselines, with improved resilience to distribution shifts. The work offers a scalable solution for edge deployment in enterprise networks, enabling accurate, fast, and robust encrypted traffic analysis without payload decryption.

Abstract

Encrypted traffic classification plays a critical role in network security and management. Currently, mining deep patterns from side-channel contents and plaintext fields through neural networks is a major solution. However, existing methods have two major limitations: (1) They fail to recognize the critical link between transport layer mechanisms and applications, missing the opportunity to learn internal structure features for accurate traffic classification. (2) They assume network traffic in an unrealistically stable and singular environment, making it difficult to effectively classify real-world traffic under environment shifts. In this paper, we propose FG-SAT, the first end-to-end method for encrypted traffic analysis under environment shifts. We propose a key abstraction, the Flow Graph, to represent flow internal relationship structures and rich node attributes, which enables robust and generalized representation. Additionally, to address the problem of inconsistent data distribution under environment shifts, we introduce a novel feature selection algorithm based on Jensen-Shannon divergence (JSD) to select robust node attributes. Finally, we design a classifier, GraphSAT, which integrates GraphSAGE and GAT to deeply learn Flow Graph features, enabling accurate encrypted traffic identification. FG-SAT exhibits both efficient and robust classification performance under environment shifts and outperforms state-of-the-art methods in encrypted attack detection and application classification.

Figures (10)

• Figure 1: The comparison with the traditional encrypted traffic classification methods. Traditional methods can only identify traffic without shifts that is consistent with the distribution of the training set. In contrast, FG-SAT can identify traffic that does not match the distribution of the training set under environment shifts.
• Figure 2: The framework of FG-SAT, including 1. Flow Graph construction, 2. JSD-based feature selection, 3. GraphSAT for encrypted traffic classification.
• Figure 3: An example of Flow Graph on TCP flow.
• Figure 4: An example of Flow Graph on UDP flow.
• Figure 5: Examples of Flow Graph with different labels.