NetLexicon improves encrypted web traffic analysis with learned behavior patterns
NetLexicon: Learning Discrete Behavioral Representations for Encrypted Web Traffic Analysis
Networking and Internet Architecture
Summary
Analyzing encrypted web traffic is difficult because the data content is hidden. The authors created NetLexicon, a method that breaks down traffic into discrete behavior patterns learned from unlabeled data. This helps computers better identify and understand patterns in communication without decrypting it. Their method boosts accuracy and speeds up training for tasks like detecting malware or identifying web services.
What this means in practice
- •For network security teams: Detect malware hidden in encrypted web traffic by recognizing recurring communication behaviors efficiently and accurately.
- •For web service operators: Identify service types and applications in encrypted traffic to improve monitoring and resource management without decrypting data.
Authors
Xiangyu Gao, Tong Li, Ziqiang Wang, Yinchao Zhang, Rongbang Wu, Zhenxing Zhang, Jing Hu, Hanlin Huang, Xinle Du, Su Yao, Qi Li, Ke Xu
Abstract
Encrypted Web traffic analysis requires effective representations of observable communication behavior. Existing pretraining methods often adapt NLP/CV objectives and sequence architectures, motivating learning objectives that capture traffic-specific interaction patterns. We present NetLexicon, a discrete pretraining framework that learns reusable behavioral states from unlabeled traffic. It converts contextual traffic windows into discrete states through vector quantization, constructing a compact traffic lexicon. We design two complementary pretraining objectives. State Transition Prediction (STP) forecasts subsequent sequence structure and packet features from observed history, while Statistical Feature Alignment (SFA) grounds learned states in window-level traffic statistics. Together, they guide the lexicon to capture recurring communication behaviors and their evolution. We evaluate NetLexicon on four benchmarks covering Web application identification, service type identification, and malware detection. NetLexicon improves Macro-F1 by up to 25.5 percentage points over the strongest baseline on each benchmark and reduces fine-tuning time per epoch by up to 23.6 times relative to the evaluated baselines. Further analysis shows that the learned discrete states capture recognizable patterns in packet size, timing, and data transfer. These results demonstrate that incorporating observable behavioral structure into pretraining supports effective, efficient, and interpretable representations for encrypted traffic analysis.