Traffic-CBM: A Structurally Interpretable Multimodal Framework for Encrypted Traffic Classification

• URL: http://arxiv.org/abs/2606.29909v1
• Date: Mon, 29 Jun 2026 07:44:56 GMT
• Title: Traffic-CBM: A Structurally Interpretable Multimodal Framework for Encrypted Traffic Classification
• Abstract summary: We propose Traffic-CBM, a structurally interpretable multimodal framework for encrypted traffic classification.<n>Instead of directly fusing heterogeneous traffic signals into a black-box representation, Traffic-CBM organizes them into a unified hierarchical concept space.<n>Results show that Traffic-CBM achieves competitive and balanced classification performance while providing a clearer structural interpretation interface.
• Score: 5.591206695889022
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Encrypted traffic classification has achieved strong performance, but its decision process remains difficult to interpret. Existing methods usually combine flow statistics, packet sequences, and byte-level representations into opaque latent features, making it unclear which type of evidence actually drives the prediction. In this paper, we propose Traffic-CBM, a structurally interpretable multimodal framework for encrypted traffic classification. Instead of directly fusing heterogeneous traffic signals into a black-box representation, Traffic-CBM organizes them into a unified hierarchical concept space. These concepts are not manually annotated semantic attributes; rather, they are scalar evidence summaries constrained by predefined traffic evidence groups. More specifically, grouped flow statistics are mapped to statistical concepts, dedicated temporal encoders learn temporal concepts from disjoint feature subspaces, and byte-level evidence is further organized into packet-level and cross-packet concepts. This design turns heterogeneous traffic evidence into an explicit concept representation and makes different levels of traffic evidence easier to analyze. We evaluate Traffic-CBM on multiple encrypted traffic benchmarks. Results show that it achieves competitive and balanced classification performance while providing a clearer structural interpretation interface than conventional end-to-end fusion models. Further analyses suggest that the learned concept space is actively used in the prediction process and provides a clearer structural explanation of multimodal traffic evidence.

Related papers

• TDDM-Melatt: A Decoupled Memory and Diffusion Framework for Generalizable Encrypted Traffic Classification [8.96087505726163]
  We propose a disentangled memory-based traffic classification framework with diffusion-based data augmentation.<n>We design Melatt, a memory-decoupled traffic representation model, which employs Competitive Gating Long Short-Term Memory (CG-LSTM) to construct the encoder and decoder.<n>Under strict flow-level splitting and anonymization, TDDM-Melatt outperforms 6 basic classification models and 6 SOTA representation learning models.
  arXiv  Detail & Related papers  (2026-08-31T13:11:52Z)
• Multimodal Reasoning with LLM for Encrypted Traffic Interpretation: A Benchmark [12.257114438374975]
  This paper proposes an end-to-end traffic-language representation framework (mmTraffic), a multimodal reasoning architecture bridging physical traffic encoding and semantic interpretation.<n>By a perception-centered traffic encoder and a cognition-centered LLM generator, mmTraffic achieves refined traffic interpretation with guaranteed category prediction.
  arXiv  Detail & Related papers  (2026-04-09T11:56:28Z)
• TrafficMoE: Heterogeneity-aware Mixture of Experts for Encrypted Traffic Classification [12.748275751587363]
  Encrypted traffic classification is a critical task for network security.<n>The one-size-fits-all static design is inherently flawed.<n>We propose TrafficMoE, a framework that breaks through the bottleneck of static modeling.
  arXiv  Detail & Related papers  (2026-03-31T10:05:54Z)
• Perception-Aware Multimodal Spatial Reasoning from Monocular Images [57.42071289037214]
  spatial reasoning from monocular images is essential for autonomous driving.<n>Current Vision-Language Models (VLMs) still struggle with fine-grained geometric perception.<n>We propose a perception-aware multimodal reasoning framework that equipsVLMs with explicit object-centric grounding ability.
  arXiv  Detail & Related papers  (2026-03-07T02:05:12Z)
• Building Transparency in Deep Learning-Powered Network Traffic Classification: A Traffic-Explainer Framework [2.289837306672451]
  We propose Traffic-Explainer, a model-agnostic and input-perturbation-based traffic explanation framework.<n>By maximizing the mutual information between predictions on original traffic sequences, Traffic-Explainer uncovers the most influential features driving model predictions.<n>Experiments demonstrate that Traffic-Explainer improves upon existing explanation methods by approximately 42%.
  arXiv  Detail & Related papers  (2025-09-22T16:46:12Z)
• FlowletFormer: Network Behavioral Semantic Aware Pre-training Model for Traffic Classification [30.24173558233433]
  FlowletFormer is a BERT-based pre-training model specifically designed for network traffic analysis.<n>FlowletFormer significantly outperforms existing methods in the effectiveness of traffic representation, classification accuracy, and few-shot learning capability.
  arXiv  Detail & Related papers  (2025-08-27T14:32:15Z)
• METER: Multi-modal Evidence-based Thinking and Explainable Reasoning -- Algorithm and Benchmark [48.78602579128459]
  We introduce METER, a unified benchmark for interpretable forgery detection spanning images, videos, audio, and audio-visual content.<n>Our dataset comprises four tracks, each requiring not only real-vs-fake classification but also evidence-chain-based explanations.
  arXiv  Detail & Related papers  (2025-07-22T03:42:51Z)
• MIETT: Multi-Instance Encrypted Traffic Transformer for Encrypted Traffic Classification [59.96233305733875]
  Classifying traffic is essential for detecting security threats and optimizing network management.<n>We propose a Multi-Instance Encrypted Traffic Transformer (MIETT) to capture both token-level and packet-level relationships.<n>MIETT achieves results across five datasets, demonstrating its effectiveness in classifying encrypted traffic and understanding complex network behaviors.
  arXiv  Detail & Related papers  (2024-12-19T12:52:53Z)
• Hints of Prompt: Enhancing Visual Representation for Multimodal LLMs in Autonomous Driving [55.609997552148826]
  We propose the Hints of Prompt (HoP) framework, which introduces three key enhancements.<n>These hints are fused through a Hint Fusion module, enriching visual representations by capturing driving-related representations with limited domain data.<n>Extensive experiments confirm the effectiveness of the HoP framework, showing that it significantly outperforms previous state-of-the-art methods in all key metrics.
  arXiv  Detail & Related papers  (2024-11-20T06:58:33Z)
• Multi-view Multi-label Anomaly Network Traffic Classification based on MLP-Mixer Neural Network [55.21501819988941]
  Existing network traffic classification based on convolutional neural networks (CNNs) often emphasizes local patterns of traffic data while ignoring global information associations. We propose an end-to-end network traffic classification method.
  arXiv  Detail & Related papers  (2022-10-30T01:52:05Z)
• Guiding the PLMs with Semantic Anchors as Intermediate Supervision: Towards Interpretable Semantic Parsing [57.11806632758607]
  We propose to incorporate the current pretrained language models with a hierarchical decoder network. By taking the first-principle structures as the semantic anchors, we propose two novel intermediate supervision tasks. We conduct intensive experiments on several semantic parsing benchmarks and demonstrate that our approach can consistently outperform the baselines.
  arXiv  Detail & Related papers  (2022-10-04T07:27:29Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.