Abstract:
Encrypted traffic identification is crucial for network security and management. Although existing deep learning methods can recognize the application type or specific application of network traffic, most models are designed for specific tasks and lack adaptability to diverse scenarios. To address this limitation, this paper proposes a local and global traffic interaction model (LGTI). First, different fields within a data packet are independently embedded to avoid the confusion of byte-level semantic information. Then, a local feature learning module and a global feature learning module are designed in the model architecture to identify key local byte information and model the global byte-order relationships, respectively. Finally, an interaction attention mechanism between local and global traffic features is introduced to promote information interaction and fusion, thereby enhancing the model’s ability to represent complex traffic patterns. Experimental results show that, in both packet-level and flow-level traffic classification tasks, the LGTI model achieves significant improvements in generalization ability and classification accuracy.