Research map / Architectures and efficiency / Attention and transformers

MIETT: Multi-Instance Encrypted Traffic Transformer for Encrypted Traffic Classification

AAAI 2025 · Architectures and efficiency › Attention and transformers · approach: Transformer expressivity and circuits · 20 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes MIETT, a multi-instance transformer that treats each packet of a flow as an instance with two-level (packet and flow) attention, plus two new pre-training tasks (PRPP, FCL), for encrypted traffic classification.

Problem

Encrypted traffic classification relies on token-level modeling that misses inter-packet flow patterns, since tokens in encrypted traffic carry little semantic information, and existing foundation models do not model packet relationships well.

Approach

Represent a flow as a bag of packets (multi-instance) and apply two-level attention, packet attention within each packet and flow attention across packets at each position, combined with packet relative position prediction and flow contrastive learning pre-training.

Key results

• MIETT reaches 93.00% accuracy and 82.36% F1 on CrossPlatform (Android), beating ET-BERT's 84.63%/67.70% reported by NetBench baselines.
• On CrossPlatform (iOS) MIETT achieves 79.63% accuracy and 75.03% F1, the best among compared methods.
• On ISCXVPN 2016 MIETT attains the best F1 (77.86%) but lower accuracy than YaTC (78.05% vs 76.07%); on ISCXTor it trails YaTC in accuracy and F1.

Measured effects reported in the paper

Surprising findings

• Using only the first packet gave 91.79% accuracy on CrossPlatform (Android), higher than all baselines using five packets, suggesting initial packets carry most information.
• Removing packet attention drops CrossPlatform (Android) accuracy to 62.19%, showing token-mean packet embeddings are much weaker.

Limitations

• Mismatch between five packets in pre-training and three in some fine-tuning settings may hurt performance, as the authors note.
• Does not consistently beat YaTC on ISCXTor and ISCXVPN accuracy; gains are dataset-dependent.
• Baseline results are taken from NetBench rather than re-run under identical settings.

Experimental setup

Datasets: ISCXVPN 2016 ISCXTor 2016 CrossPlatform (Android) CrossPlatform (iOS) CICIoT 2023

Benchmarks: ISCXVPN 2016 ISCXTor 2016 CrossPlatform (Android) CrossPlatform (iOS) CICIoT 2023

Metrics: accuracy F1-score

Baselines: Datanet Fs-Net BiLSTM_ATTN DeepPacket TSCRNN ET-BERT YaTC

Builds on: ET-BERT YaTC ViT PERT

Closest papers by meaning

• Revolutionizing Encrypted Traffic Classification with MH-Net: A Multi-View Heterogeneous Graph Model (AAAI 2025 · similarity 0.90)
• Dual-Channel Interactive Graph Transformer for Traffic Classification with Message-Aware Flow Representation (AAAI 2025 · similarity 0.82)
• MalDetectFormer: Leveraging Sparse SpatioTemporal Information for Effective Malicious Traffic Detection (AAAI 2025 · similarity 0.81)
• SSL-STMFormer Self-Supervised Learning Spatio-Temporal Entanglement Transformer for Traffic Flow Prediction (AAAI 2025 · similarity 0.80)
• MIA-Tuner: Adapting Large Language Models as Pre-training Text Detector (AAAI 2025 · similarity 0.80)
• DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders (CVPR 2025 · similarity 0.79)