PACC: Protocol-Aware Cross-Layer Compression for Compact Network Traffic Representation

TL;DR

PACC tackles the redundancy in cross-layer network traffic representations by treating protocol layers as multiview inputs and factorizing representations into shared and private components. It jointly optimizes layer-wise projections, cross-layer consensus via contrastive learning, and task relevance through supervised objectives, all fused by an uncertainty-aware mechanism. Empirical results across encrypted traffic, IoT, and intrusion detection tasks show that PACC surpasses feature-engineered and raw-bit baselines and competes with pretrained embeddings, while delivering substantial efficiency gains. The approach provides layer-level interpretability and robust performance under domain shifts and masking, making it practical for scalable, privacy-conscious network monitoring.

Abstract

Network traffic classification is a core primitive for network security and management, yet it is increasingly challenged by pervasive encryption and evolving protocols. A central bottleneck is representation: hand-crafted flow statistics are efficient but often too lossy, raw-bit encodings can be accurate but are costly, and recent pre-trained embeddings provide transfer but frequently flatten the protocol stack and entangle signals across layers. We observe that real traffic contains substantial redundancy both across network layers and within each layer; existing paradigms do not explicitly identify and remove this redundancy, leading to wasted capacity, shortcut learning, and degraded generalization. To address this, we propose PACC, a redundancy-aware, layer-aware representation framework. PACC treats the protocol stack as multi-view inputs and learns compact layer-wise projections that remain faithful to each layer while explicitly factorizing representations into shared (cross-layer) and private (layer-specific) components. We operationalize these goals with a joint objective that preserves layer-specific information via reconstruction, captures shared structure via contrastive mutual-information learning, and maximizes task-relevant information via supervised losses, yielding compact latents suitable for efficient inference. Across datasets covering encrypted application classification, IoT device identification, and intrusion detection, PACC consistently outperforms feature-engineered and raw-bit baselines. On encrypted subsets, it achieves up to a 12.9% accuracy improvement over nPrint. PACC matches or surpasses strong foundation-model baselines. At the same time, it improves end-to-end efficiency by up to 3.16x.

Figures (8)

• Figure 1: Illustration of the shared--private principle for cross-layer traffic. We seek representations that capture both cross-layer consensus $I(X_i;X_j)$ and layer-specific, task-relevant evidence such as $I(X_i;Y \mid X_j)$.
• Figure 2: Representation structure on CipherSpectrum-4. Two-dimensional projections of node representations with Silhouette scores.
• Figure 3: Layer-wise perspective on NMI and compression. (a) Task-relevant Cross-layer PCA-normalized conditional mutual information $I(X_i; X_j | Y)$. (b) Task relevance quantified by $I(X_i; Y)$ (higher is better) and redundancy proxied by the compression ratio (lower implies compactness).
• Figure 4: The overall framework of PACC. It consists of two main parts: the Model Backbone and the Loss Objective. The backbone extracts multi-layer representations ($Z_1$ to $Z_4$) from raw traffic using nPrint encoding and fuses them via an Uncertainty-aware Attention mechanism. The model is optimized jointly using reconstruction loss ($\mathcal{L}_{rec}$), consensus loss ($\mathcal{L}_{con}$), and classification losses ($\mathcal{L}_{ce}$, $\mathcal{L}^{G}_{ce}$).
• Figure 5: Layer-wise perspective on NMI and compression of PACC embeddings. (a) Cross-layer PCA-normalized conditional mutual information $I(X_i; X_j | Y)$. (b) Comparison of task relevance $I(X; Y)$ and redundancy (compression ratio) between raw features and learned representations.

Theorems & Definitions (15)

• Definition 3.1
• Proposition 4.1
• Definition 4.1
• Theorem 4.1
• Proposition 4.2
• Proposition A.1
• Lemma A.1: Variational Lower Bound
• proof
• Lemma A.2: vMF Likelihood and Cosine Equivalence
• proof