Research map / Graph learning / Knowledge and temporal graphs
Dual-Channel Interactive Graph Transformer for Traffic Classification with Message-Aware Flow Representation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DigTraffic, a dual-channel interactive graph Transformer that builds message-level traffic interaction graphs and encodes packet length and timing sequences to classify encrypted traffic flows.
Problem
Encrypted traffic classification relies on raw packet features and misses global inter-packet correlations, and existing methods struggle to jointly use packet-length and temporal information together with graph structure.
Approach
Builds message-level traffic interaction graphs with three heterogeneous edge types capturing client-server message interactions, encodes length and time sequences with parallel Transformer encoders, and applies a graph Transformer with centrality, shortest-path spatial, and edge encodings in attention.
Key results
- DigTraffic reaches 98.14% accuracy and 97.96% F1 on ISCX-VPN2016, beating the second-best GAT (90.12%) by about 8 points.
- On ISCX-Tor2016, DigTraffic achieves 98.57% accuracy, versus 85.92% for GAT.
- On QUIC2019 and CICIoT2022, DigTraffic reports 96.41% and 96.91% accuracy respectively.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| replace average pooling with max pooling (ablation) | DigTraffic · ISCX-VPN2016, ISCX-Tor2016, QUIC2019, CICIoT2022 | accuracy: 98.14% -> 97.50%; 98.57% -> 97.31%; 96.41% -> 96.95%; 96.91% -> 96.33% | Mixed |
| add secondary uni-direction edges (2UE) (ablation) | DigTraffic · ISCX-VPN2016, ISCX-Tor2016, QUIC2019, CICIoT2022 | accuracy: 95.81% -> 98.14%; 93.65% -> 98.57%; 91.72% -> 96.41%; 93.19% -> 96.91% | Helped |
| add changed-direction edges (CDE) and 2UE (ablation) | DigTraffic · ISCX-VPN2016, ISCX-Tor2016, QUIC2019, CICIoT2022 | accuracy: 93.30% -> 98.14%; 91.06% -> 98.57%; 92.60% -> 96.41%; 91.53% -> 96.91% | Helped |
| add successive uni-direction edges (SUE) and 2UE (ablation) | DigTraffic · ISCX-VPN2016, ISCX-Tor2016, QUIC2019, CICIoT2022 | accuracy: 97.77% -> 98.14%; 96.92% -> 98.57%; 96.53% -> 96.41%; 95.82% -> 96.91% | Helped |
| add SUE and CDE (ablation) | DigTraffic · ISCX-VPN2016, ISCX-Tor2016, QUIC2019, CICIoT2022 | accuracy: 90.56% -> 98.14%; 88.39% -> 98.57%; 90.94% -> 96.41%; 91.08% -> 96.91% | Helped |
| use heterogeneous rather than homogeneous edge types (ablation) | DigTraffic · ISCX-VPN2016, ISCX-Tor2016, QUIC2019, CICIoT2022 | accuracy: 89.48% -> 98.14%; 87.64% -> 98.57%; 90.36% -> 96.41%; 91.86% -> 96.91% | Helped |
| add packet-length sequence encoding (LSE) (ablation) | DigTraffic · ISCX-VPN2016, ISCX-Tor2016, QUIC2019, CICIoT2022 | accuracy: 91.57% -> 98.14%; 88.25% -> 98.57%; 89.90% -> 96.41%; 94.06% -> 96.91% | Helped |
| add temporal sequence encoding (TSE) (ablation) | DigTraffic · ISCX-VPN2016, ISCX-Tor2016, QUIC2019, CICIoT2022 | accuracy: 94.50% -> 98.14%; 93.17% -> 98.57%; 95.83% -> 96.41%; 96.39% -> 96.91% | Helped |
| add both LSE and TSE (ablation) | DigTraffic · ISCX-VPN2016, ISCX-Tor2016, QUIC2019, CICIoT2022 | accuracy: 90.36% -> 98.14%; 89.30% -> 98.57%; 89.55% -> 96.41%; 90.11% -> 96.91% | Helped |
| add centrality encoding (CE) (ablation) | DigTraffic · ISCX-VPN2016, ISCX-Tor2016, QUIC2019, CICIoT2022 | accuracy: 90.29% -> 98.14%; 88.83% -> 98.57%; 89.50% -> 96.41%; 91.49% -> 96.91% | Helped |
| add spatial encoding (SE) (ablation) | DigTraffic · ISCX-VPN2016, ISCX-Tor2016, QUIC2019, CICIoT2022 | accuracy: 91.57% -> 98.14%; 86.45% -> 98.57%; 93.98% -> 96.41%; 90.91% -> 96.91% | Helped |
| add edge encoding (2E) (ablation) | DigTraffic · ISCX-VPN2016, ISCX-Tor2016, QUIC2019, CICIoT2022 | accuracy: 97.10% -> 98.14%; 95.04% -> 98.57%; 95.88% -> 96.41%; 95.19% -> 96.91% | Helped |
Surprising findings
- Replacing max pooling with average pooling changes results only modestly, while removing heterogeneous edge types or the edge encoding causes large drops.
Limitations
- Complexity is quadratic in the number of graph nodes, and the model needs fixed-length packet sequences via padding and truncation.
- Evaluated only on four public encrypted traffic datasets with no comparison to pretrained traffic foundation models.
Experimental setup
Datasets: ISCX-VPN2016 ISCX-Tor2016 QUIC2019 CICIoT2022
Benchmarks: ISCX-VPN2016 ISCX-Tor2016 QUIC2019 CICIoT2022
Metrics: Accuracy F1 Precision Recall
Baselines: CUMUL AppScanner DeepPacket 3D-CNN FS-Net bi-LSTM Transformer GCN-RTG GAT
Builds on: Graphormer Transformer GCN GAT
Closest papers by meaning
- Spatio-Temporal Graph Structure Learning for Traffic Forecasting (AAAI 2020 · similarity 0.86)
- Efficient Traffic Prediction Through Spatio-Temporal Distillation (AAAI 2025 · similarity 0.85)
- Revolutionizing Encrypted Traffic Classification with MH-Net: A Multi-View Heterogeneous Graph Model (AAAI 2025 · similarity 0.84)
- Spatio-Temporal Pivotal Graph Neural Networks for Traffic Flow Forecasting (AAAI 2024 · similarity 0.83)
- SSL-STMFormer Self-Supervised Learning Spatio-Temporal Entanglement Transformer for Traffic Flow Prediction (AAAI 2025 · similarity 0.83)
- TelTrans: Applying Multi-Type Telecom Data to Transportation Evaluation and Prediction via Multifaceted Graph Modeling (AAAI 2024 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.