SAT-Net: A staggered attention network using graph neural networks for encrypted traffic classification

Abstract

With the increasing complexity of network protocol traffic in the modern network environment, the task of traffic classification is facing significant challenges. Existing methods lack research on the characteristics of traffic byte data and suffer from insufficient model generalization, leading to decreased classification accuracy. In response, we propose a method for encrypted traffic classification based on a Staggered Attention Network using Graph Neural Networks (SAT-Net), which takes into consideration both computer network topology and user interaction processes. Firstly, we design a Packet Byte Graph (PBG) to efficiently capture the byte features of flow and their relationships, thereby transforming the encrypted traffic classification problem into a graph classification problem. Secondly, we meticulously construct a GNN-based PBG learner, where the feature remapping layer and staggered attention layer are respectively used for feature propagation and fusion, enhancing the robustness of the model. Experiments on multiple different types of encrypted traffic datasets demonstrate that SAT-Net outperforms various advanced methods in identifying VPN traffic, Tor traffic, and malicious traffic, showing strong generalization capability.