Lightweight Encrypted Traffic Classification via Cross-Attention Fusion for Resource-Constrained Networks

Abstract

The widespread adoption of TLS encryption has rendered traditional deep packet inspection ineffective, compelling network operators to rely on behavioral features for application identification. While existing deep learning approaches achieve high accuracy, their considerable parameter counts limit deployment on storage-constrained edge devices. This paper proposes a lightweight dual-branch architecture that integrates packet-level temporal sequences with flow-level statistics through a cross-attentive fusion mechanism. Unlike conventional concatenation or gating strategies, the proposed model treats flow statistics as queries to actively retrieve relevant patterns from packet sequences, enabling more expressive interaction between heterogeneous features with modest parameter overhead. We further provide an empirical analysis of critical design choices for adapting Transformers to fixed-length traffic truncation, including positional encoding strategies, fusion mechanisms, and padding policies. Evaluated on the public CESNET-TLS dataset, the proposed architecture achieves a favorable accuracy-parameter trade-off compared with a retrained deep baseline under identical training conditions, and reveals that standard PyTorch padding masks cause severe CPU inference degradation in short-sequence traffic tasks.