Curv-Tail improves encrypted traffic detection with fewer resources
Curv-Tail: Lightweight Long-Tailed Encrypted Traffic Classification with Discrete Packet-Length Encoding and Lorentz Prototypes
Cryptography and Security
Summary
Classifying internet traffic that is encrypted and has many rare types is challenging, especially when computing power is limited. The authors created Curv-Tail, a lightweight method that captures exact packet sizes without creating a huge vocabulary, and uses a special way to understand sequence data for better classification. It performs better than previous methods on two test sets and is much faster and smaller in terms of computational needs. This makes it easier to detect different kinds of encrypted traffic accurately and quickly.
What this means in practice
- •For network security teams: Classify encrypted network traffic into many categories with improved accuracy and low computational cost for better threat detection.
- •For internet service providers: Improve traffic profiling and monitoring at scale using a faster, more parameter-efficient classifier for encrypted flows.
Authors
Yankun Wang, Jun-Jie Huang, Lin Liu, Xiaodong Lei, Yi Chen, Yeqing Yan, Lin Liu, Jiangyong Shi, Yongjun Wang
Abstract
Long-tailed encrypted traffic classification requires accurate recognition of infrequent classes under limited computational budgets. We propose Curv-Tail, a lightweight, end-to-end packet--byte framework trained without a separate pretraining stage. Mixed-resolution tokenization preserves exact packet-length identities within a bounded range and coarsens larger values to limit the vocabulary. An auxiliary objective predicts observed length tokens from contextual packet features before pooling, encouraging length-token retention beyond flow-level supervision. Compact temporal encoders process packet sequences and directional byte patches, and Lorentz prototypes with a shared learnable curvature magnitude classify their fused representation. On NUDT-Mobile and DataCon-Website under natural class frequencies, Curv-Tail achieves three-seed mean Tail-F1 scores of 85.70% and 46.30%, exceeding the strongest evaluated baselines by 2.91 and 1.89 percentage points, respectively. In 300-class profiling on an RTX 4090 with FP32 and batch size 256, Curv-Tail uses 98.48% fewer parameters and achieves 10.2 times the batch inference throughput of MM4Flow.