Research map / Graph learning / Graph self-supervised learning

Revolutionizing Encrypted Traffic Classification with MH-Net: A Multi-View Heterogeneous Graph Model

AAAI 2025 · Graph learning › Graph self-supervised learning · approach: Heterophily and imbalance on graphs · 30 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes MH-Net, which builds multi-view heterogeneous traffic graphs from 4-bit and 8-bit traffic units linked by PMI, encodes them with a heterogeneous GraphSAGE and LSTM, and trains with multi-task supervised contrastive learning for packet- and flow-level encrypted traffic classification.

Problem

Encrypted traffic classification is hard because byte-based methods treat bytes as indivisible units with rigid granularity and mix different types of byte correlations (header vs. payload).

Approach

Aggregate raw bits into multiple unit granularities (4-bit and 8-bit), convert each unit sequence into a PMI-based traffic graph with three edge types (header-header, payload-payload, header-payload), encode with a heterogeneous GraphSAGE, and jointly optimize classification with packet-level and flow-level supervised contrastive losses.

Key results

• On flow-level classification, MH-Net achieves AC 0.9900 / F1 0.9896 on CIC-IoT and AC 0.9942 / F1 0.9941 on ISCX-VPN, ranking first on average among 11 methods.
• On packet-level classification, MH-Net achieves AC 0.9768 / F1 0.9766 on ISCX-VPN and AC 0.8822 / F1 0.8814 on ISCX-nonVPN, ranking first on average among 11 methods.
• Ablation on CIC-IoT flow-level F1 shows removing the heterogeneous edge types drops F1 from 0.9896 to 0.9154, and removing the 8-bit view drops it to 0.8842.

Measured effects reported in the paper

Surprising findings

• Combining some unit granularities (e.g., 2&8-bit, 6&8-bit) yields worse results than a single 8-bit view, indicating interference between traffic units.
• Removing the packet-level contrastive loss yields a flow-level F1 on CIC-IoT (0.9835) that is close to the full model (0.9896), with contrastive gains varying across tasks and datasets.

Limitations

• Only 4-bit and 8-bit units are used in main experiments due to computational cost; the search over unit combinations is limited to a small set.
• Flow length is capped at 15 packets and ISCX-Tor flows are split into 60-second blocks, which may limit generality.
• Some hyperparameters (contrastive loss ratios) vary per dataset, and sensitivity to beta fluctuates.

Experimental setup

Datasets: CIC-IoT ISCX VPN-nonVPN ISCX Tor-nonTor CrossPlatform(Android)

Benchmarks: CIC-IoT ISCX-Tor ISCX-nonTor ISCX-VPN ISCX-nonVPN CrossPlatform(Android)

Metrics: Accuracy Macro F1 Avg. Rank

Baselines: AppScanner K-FP CUMUL ETC-PS FS-Net DF ET-BERT GraphDApp TFE-GNN YaTC Securitas 2D-CNN

Builds on: TFE-GNN GraphSAGE supervised contrastive learning PacRep

Closest papers by meaning

• MIETT: Multi-Instance Encrypted Traffic Transformer for Encrypted Traffic Classification (AAAI 2025 · similarity 0.90)
• Dual-Channel Interactive Graph Transformer for Traffic Classification with Message-Aware Flow Representation (AAAI 2025 · similarity 0.84)
• MalDetectFormer: Leveraging Sparse SpatioTemporal Information for Effective Malicious Traffic Detection (AAAI 2025 · similarity 0.79)
• FicGCN: Unveiling the Homomorphic Encryption Efficiency from Irregular Graph Convolutional Networks (ICML 2025 · similarity 0.79)
• SSL-STMFormer Self-Supervised Learning Spatio-Temporal Entanglement Transformer for Traffic Flow Prediction (AAAI 2025 · similarity 0.78)
• Self-Supervised Learning of Graph Representations for Network Intrusion Detection (NeurIPS 2025 · similarity 0.78)