Treat Traffic Like Trees: A Semantic-Preserving Hierarchical Graph-Based Expert Framework for Encrypted Traffic Analysis
2026-06-03 • Networking and Internet Architecture
Networking and Internet ArchitectureArtificial Intelligence
AI summaryⓘ
The authors developed a new method called PTGAMoE to analyze encrypted network traffic using graphs that respect the natural hierarchy of protocols and their fields. Unlike previous approaches that may lose important protocol details, their method keeps the structure intact and uses specialized experts to focus on different parts of the data. Tests on common datasets showed their approach works better than existing models. Additionally, their design helps explain which parts of the data and experts influenced the model’s decisions.
encrypted traffic analysisgraph neural networksprotocol hierarchygraph attentionmixture of expertssemantic preservationfeature importancenetwork protocolsrepresentation learning
Authors
Yuantu Luo, Jun Tao, Linxiao Yu, Guang Cheng
Abstract
Graph-based deep learning methods have been widely employed in encrypted traffic analysis to exploit latent correlations across different granularities. However, while complex preprocessing pipelines and sophisticated model structures often achieve strong performance, they may obscure inherent protocol semantics during representation learning. Moreover, the hierarchical structure of protocol layers and their corresponding fields, defined by protocol specifications and routinely utilized in manual traffic analysis, remains underexplored in existing learning frameworks. In this paper, we propose Protocol Tree Graph Attention with Mixture of Experts (PTGAMoE), a semantic-preserving hierarchical graph-based expert framework for encrypted traffic analysis. The field-based graph construction and expert committee design enable PTGAMoE to quantify the model's preferences for specific fields and protocols. Extensive experimental results on representative benchmark datasets under strict no-data-leakage settings demonstrate that PTGAMoE significantly outperforms state-of-the-art (SOTA) models. Furthermore, the semantic-preserving design provides interpretable insights into protocol-level feature importance and expert-level contributions, reflecting the model's decision-making logic in encrypted traffic classification tasks.