TrafficMoE: 一种面向异质性的混合专家模型用于加密流量分类
TrafficMoE: Heterogeneity-aware Mixture of Experts for Encrypted Traffic Classification
AI总结：
本文提出TrafficMoE，通过Disentangle-Filter-Aggregate框架解决加密流量分类中的异质性问题，采用双分支稀疏MoE分离头部和负载，引入不确定性感知过滤机制和路由引导策略提升分类性能。
摘要：
加密流量分类是网络安全中的关键任务。尽管深度学习推动了该领域的发展，但加密对载荷语义的遮蔽严重挑战了标准建模方法。现有框架多采用静态和同质的流水线，统一参数共享和静态融合策略。这种一刀切的静态设计存在固有缺陷：通过将结构化头部和随机负载纳入统一处理流程，不可避免地将原始协议信号与随机加密噪声纠缠，从而降低细粒度判别特征。本文提出TrafficMoE，通过建立Disentangle-Filter-Aggregate（DFA）范式突破静态建模瓶颈。具体而言，为解决组件间的冲突，架构利用双分支稀疏混合专家（MoE）分离头部和负载，实现模态特定建模。为缓解随机噪声的影响，引入不确定性感知过滤机制以量化可靠性并选择性抑制高方差表示。最后，为克服静态融合的限制，采用路由引导策略动态聚合跨模态特征，根据流量上下文自适应加权贡献。通过DFA范式，TrafficMoE通过专注于最判别性的流量特征最大化表征效率。在六个数据集上的广泛实验表明，TrafficMoE在性能上始终优于最先进方法，验证了在加密流量分析中异质性感知建模的必要性。源代码可在https://github.com/Posuly/TrafficMoE_main公开获取。
英文摘要：
Encrypted traffic classification is a critical task for network security. While deep learning has advanced this field, the occlusion of payload semantics by encryption severely challenges standard modeling approaches. Most existing frameworks rely on static and homogeneous pipelines that apply uniform parameter sharing and static fusion strategies across all inputs. This one-size-fits-all static design is inherently flawed: by forcing structured headers and randomized payloads into a unified processing pipeline, it inevitably entangles the raw protocol signals with stochastic encryption noise, thereby degrading the fine-grained discriminative features. In this paper, we propose TrafficMoE, a framework that breaks through the bottleneck of static modeling by establishing a Disentangle-Filter-Aggregate (DFA) paradigm. Specifically, to resolve the structural between-components conflict, the architecture disentangles headers and payloads using dual-branch sparse Mixture-of-Experts (MoE), enabling modality-specific modeling. To mitigate the impact of stochastic noise, an uncertainty-aware filtering mechanism is introduced to quantify reliability and selectively suppress high-variance representations. Finally, to overcome the limitations of static fusion, a routing-guided strategy aggregates cross-modality features dynamically, that adaptively weighs contributions based on traffic context. With this DFA paradigm, TrafficMoE maximizes representational efficiency by focusing solely on the most discriminative traffic features. Extensive experiments on six datasets demonstrate TrafficMoE consistently outperforms state-of-the-art methods, validating the necessity of heterogeneity-aware modeling in encrypted traffic analysis. The source code is publicly available at https://github.com/Posuly/TrafficMoE_main.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
