TitNet: A time-series model based on multi-period nesting for encrypted traffic classification

Abstract

Encrypted traffic classification is essential for network management tasks such as quality-of-service controls, identifying malicious traffic, and enhancing cybersecurity. However, the scarcity of plaintext information and the significant reduction of payload characteristics in encrypted traffic present challenges to effective classification. To tackle these issues, we propose a novel time series model called TitNet, which models network traffic at the session level as a multivariate time series and effectively integrates periodic and spatial features inherent in time series data. Our TitNet contains a dynamic frequency selection strategy(DFSS) that facilitates the conversion of time series data into two-dimensional tensor representations, which is pivotal for accurately discerning the intricate patterns embedded in encrypted traffic. This approach enables TitNet to iteratively transform time series into 2D tensors, effectively exploiting the multi-period nesting characteristics of the data to improve classification performance. Experimental results on the ISCXTor2016 dataset (43 Tor/NonTor categories) robustly indicate that our TitNet excels in the detection, classification, and identification of applications within encrypted traffic, achieving 96.21 % accuracy while handling extreme class imbalance. Nonetheless, TitNet introduces additional computational overhead and relies on fixed session truncation, which may limit scalability and long-range modeling. Future work will explore lightweight variants and improved sequence aggregation strategies to address these challenges.