S2F-GNN: A self-supervised robust encrypted traffic classification method based on dynamic heterogeneous graphs

Abstract

Encrypted traffic classification is a critical task in network security and management. However, existing methods often neglect the structural and multi-dimensional correlations of traffic. Furthermore, their heavy reliance on large-scale labeled data limits their generalization ability in dynamic networks. To address the above limitations, this paper proposes a novel few-shot encrypted traffic classification framework based on self-supervised learning (S²F-GNN). Firstly, we represent network sessions as dynamic heterogeneous graphs consisting of flow, time, and attribute nodes. This representation effectively captures the structural features and temporal evolution of traffic in a multi-dimensional space. Secondly, we design a multi-task self-supervised framework that synergizes masked autoencoder, graph structure prediction, clustering, and contrastive learning. This framework efficiently learns universal and robust traffic representations from large-scale unlabeled data. In addition, we design a Jensen-Shannon Divergence (JSD)-based feature selection mechanism to identify features that remain stable across changing environments. This further enhances the model’s adaptability in few-shot and dynamic scenarios. Experimental results demonstrate that S²F-GNN significantly outperforms the state-of-the-art methods on multiple public datasets. Especially in the few-shot scenarios with scarce labeled data, the average accuracy and F1-score are improved by 4.04% and 9.68%, respectively.