We propose an attention-weighted model for parallel extraction of spatial-temporal features to enhance the detection capabilities in the message queuing telemetry transport protocol, widely used in the Internet of Things. Our approach involves constructing perception node collection graphs based on packet header information, which capture transmission-dependent and context-sequence-dependent relationships in the data streams. We leverage a message-passing mechanism to aggregate adjacent nodes and update the weight matrix accordingly. Additionally, we employ a bidirectional long short-term memory model to capture long-distance dependencies in the sequence. The updated graph and the output of the time-series model are fused and processed by a self-attention mechanism, generating weights for classification. The classification results are obtained using a fully connected network. We evaluate our approach on four datasets (ToN-IoT, BoT-IoT, UNSW-NB15, and DoHBrw2020) and compare it against nine different algorithms. Experimental results demonstrate the effectiveness of our method, achieving high accuracy levels, such as 0.8874 on ToN-IoT, 0.9386 on BoT-IoT, 0.9390 on DoHBrw2020, and the best accuracy of 0.8659 on the unbalanced UNSW-NB15 dataset.

Identifying encrypted traffic is essential for network management, but it becomes increasingly challenging as more and more users adopt encryption protocols and traffic defense mechanisms for data privacy. Most existing methods heavily rely on deep features and labeled samples, overlooking the opportunity to capture pattern information of datagram structure. As a consequence, these methods are unable to extract rule-based knowledge from unlabeled data, limiting their ability to identify unseen or feature-perturbed traffic. In this paper, we propose a new framework for encrypted traffic identification named Generic Encrypted Traffic Representation Framework (GETRF), which includes three pre-training tasks designed based on the datagram structure. By leveraging the advantages of these tasks, GETRF can utilize unlabeled traffic to form generic and robust representations, capturing the characteristics of datagrams at the byte, packet, and flow levels. After fine-tuning, these representations can be applied to identification tasks across multiple scenarios. The results demonstrate that GETRF achieves state-of-the-art performance in multi-scenario and fine-grained identifications, and effectively handles feature-perturbed traffic.

With the proliferation of mobile terminals and the rapid growth of network applications, fine-grained traffic identification has become increasingly challenging. Methods based on machine learning and deep learning have achieved remarkable results, but they heavily rely on the distribution of training data, which makes them ineffective in handling unseen samples. In this paper, we propose AG-ZSL, a zero-shot learning framework based on traffic behavior and attribute representations for general encrypted traffic classification. AG-ZSL primarily learns two mapping functions: one that captures traffic behavior embeddings from burst-based traffic interaction graphs, and the other that learns attribute embeddings from traffic attribute descriptions. Then, the framework minimizes the distance between these embeddings within the shared feature space. The gradient rejection algorithm and K-Nearest Neighbors are introduced to implement a two-stage method for general traffic classification. Experimental results on IoT datasets demonstrate that AG-ZSL achieves exceptional performance in classifying both known and unknown traffic, highlighting its potential for enhancing secure and efficient traffic management at the network edge.

Classifying encrypted sensor traffic is critical for the security and management of Internet of Things networks, particularly in Mobile Edge Computing (MEC) environments. Existing methods often require extensive task-specific labeled data to adapt to emerging traffic categories and may also fail to distinguish intrinsic traffic behaviors from patterns introduced by shared communication libraries, which can degrade classification accuracy under distribution shifts. To address these issues, we propose CDTF, a contrastive dual-task framework for transferable and few-shot traffic representation learning. CDTF adopts a hybrid pre-training strategy that jointly optimizes supervised triplet pretraining (STP) and self-supervised dynamic burst masking (DBM). STP uses base-class labels as structural anchors to explicitly constrain distance relationships by aligning intra-class samples and separating inter-class samples, thereby mitigating interference from shared network components. DBM models global semantic structures and enhances the robustness of traffic representations against network noise and distribution shifts. By learning discriminative and contextual representations in a shared embedding space via these two tasks, CDTF can rapidly adapt to novel categories through lightweight fine-tuning, thereby substantially reducing the reliance on large-scale fine-grained supervision in downstream tasks. Experimental results across seven public and two custom datasets, across diverse environments, show that the proposed framework outperforms state-of-the-art methods. Under the few-shot setting, CDTF improves Precision by 4.61 percentage points over the strongest baseline, with statistical significance confirmed by a paired t-test ($p<0.05$).