Mean FlowSpectrum: Enhancing Encrypted Traffic Classification via Mean-Based Similarity Correction
Abstract
As the majority of Internet traffic is now transmitted via encrypted protocols such as HTTPS, TLS 1.3, and VPNs, existing Deep Packet Inspection (DPI)-based security techniques are no longer able to operate effectively. Consequently, developing technologies capable of accurately classifying encrypted traffic without decryption is emerging as a core task in the field of network security. In this paper, Mean FlowSpectrum (Mean FS), a lightweight extension of the existing FlowSpectrum (FS) similarity rule, is proposed. Whereas FS uses only minimum distances between test samples and class spectra, Mean FS adds a class-mean consistency term to reduce errors caused by local spectral overlap. The method was evaluated with Semi-AE and Semi-2DCAE on ISCX-VPN2016, USTC-TFC2016, and a newly collected TLS 1.3/SSH attack-traffic testbed dataset. In a paired evaluation over five independent seeds, Mean FS improved macro F1-score in all six dataset–backbone combinations by 3.10–9.98 percentage points, and every paired improvement was statistically significant (<inline-formula> <tex-math notation="LaTeX">$p\lt 0.01$ </tex-math></inline-formula>). Reducing the input size from <inline-formula> <tex-math notation="LaTeX">$28\times 28$ </tex-math></inline-formula> to <inline-formula> <tex-math notation="LaTeX">$16\times 16$ </tex-math></inline-formula> maintained comparable performance while improving memory efficiency, and Mean FS substantially mitigated the degradation caused by reducing the session size from <inline-formula> <tex-math notation="LaTeX">$n=10$ </tex-math></inline-formula> to <inline-formula> <tex-math notation="LaTeX">$n=1$ </tex-math></inline-formula>. GPU memory and inference time were measured for the model-side pipeline; end-to-end live-capture latency was outside the scope of this study. Mean FS therefore provides a lightweight extension to the FlowSpectrum decision rule. The measured results support its use as a decision-stage refinement for encrypted-traffic analysis, but operational validation with benign and mixed traffic is still required.