Network traffic classification model based on attention mechanism and spatiotemporal features

Hu, Feifei; Zhang, Situo; Lin, Xubin; Wu, Liu; Liao, Niandong; Song, Yanqi · 2023 · OpenAlex-citations

DOI: 10.1186/s13635-023-00141-4

archive: archived pipeline: cataloged verified

Get this paper ↗ (DOI — opens at the source; we link to it, we don't host it)

Summary

This paper addresses the challenge of accurately classifying network traffic, particularly encrypted applications and their underlying traffic, which traditional methods struggle to identify due to port obfuscation, dynamic ports, and the inability of deep packet inspection to analyze ciphertext. The authors propose an end-to-end representation learning model that combines attention mechanisms with spatiotemporal features to automatically construct the mapping between network flows and labels without manual feature extraction. This approach aims to improve classification accuracy, generalization ability, and adaptability to diverse network environments while reducing false positives in security systems. The proposed model integrates three key components: Long Short-Term Memory (LSTM), Convolutional Neural Networks (CNN), and a Squeeze and Excitation (SE) module. First, LSTM analyzes continuous network flows to capture temporal correlation features and long-term dependencies in packet sequences. Second, CNN extracts high-order spatial features from the network flow data, identifying local patterns such as packet sizes and payload structures. Third, the SE module weights and redistributes these spatial features to emphasize informative channels and suppress less relevant ones, thereby refining the feature representation. This combined architecture allows the model to handle both encrypted and unencrypted traffic simultaneously by learning underlying patterns directly from raw data. The model was evaluated using three different datasets to verify its effectiveness and generalization capabilities. Experimental results demonstrate that the proposed method outperforms existing machine learning and deep learning approaches in most classification scenarios. The model achieves high accuracy, generally exceeding 90%, particularly in classifying the underlying traffic of encrypted applications. It effectively differentiates between similar traffic types, such as VoIP and video streaming, which often share ports and protocols, and reduces misclassification of benign traffic as malicious. The study highlights the model's strong generalization ability, allowing it to adapt quickly to different network traffic datasets without requiring prior knowledge or manual intervention. The significance of this work lies in its ability to provide a robust solution for network traffic classification in modern, encrypted network environments. By leveraging spatiotemporal features and attention mechanisms, the model offers a more accurate and flexible alternative to traditional rule-based and statistical methods. This approach supports better network resource allocation, improved security through reduced false positives, and enhanced compliance with enterprise network policies. The findings suggest that end-to-end representation learning is a promising direction for future research in network security and management, particularly as encryption technologies continue to evolve.

Provenance

The full processing record for this entry. Every stage of this paper's journey through the pipeline is logged — what ran, with which tool and model, how many attempts it took, and when it last completed.

Summary generated by qwen3.6-27b-prismaquant on 2026-06-26; verification: verified.

Topics

Ranked by relevance to this paper. Hover a topic for its definition.

• distraction detection algorithms