发表机构
Budapest University of Technology and Economics; CUJO LLC Hungary（布达佩斯技术与经济大学; CUJO匈牙利有限责任公司）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
该研究采用匹配捕获的WireGuard隧道数据集，对比不同模型在FlowFeatures与SPLT早流指纹上的跨域VPN流量分类效果，发现CNN1D处理SPLT指纹时无需VPN数据即可实现最优跨域性能。
AI 中文摘要
按应用类别对VPN加密流量进行分类通常依赖于在不同会话中收集非VPN和VPN流量的数据集，这会将封装效应与用户行为、时序及应用组合的会话级差异相混淆。我们采用了一个近期发布的WireGuard隧道数据集，该数据集可同时捕获隧道前后的流量，数据包级匹配率超过99.9%。这种匹配捕获设计消除了会话级混淆，实现了跨域基准：模型在非VPN流上训练，在同一底层流的VPN视图上测试。我们对比了全流统计聚合（FlowFeatures）和数据包长度与时间序列（SPLT）早流指纹，采用了随机森林、XGBoost及多尺度CNN1D模型。跨域迁移取决于表示方式与模型的结合：树集成模型使用FlowFeatures时的平衡准确率为0.84-0.93，而使用扁平化SPLT时仅为0.60-0.75；CNN1D将同一SPLT指纹作为序列处理，在训练时无需任何VPN数据即可实现最强的迁移效果（平衡准确率0.98，宏F1值0.89）。
英文摘要
Classifying VPN-encrypted traffic by application category typically relies on datasets that collect non-VPN and VPN traffic in separate sessions, conflating encapsulation effects with session-level differences in user behavior, timing, and application mix. We use a recently published WireGuard tunnel dataset in which pre- and post-tunnel traffic is captured simultaneously, with a packet-level match ratio above 99.9%. This matched-capture design eliminates session-level confounds and enables a cross-domain benchmark: models are trained on non-VPN flows and tested on the VPN view of the same underlying flows. We compare whole-flow statistical aggregates (FlowFeatures) and Sequence of Packet Length and Time (SPLT) early-flow fingerprints across Random Forest, XGBoost, and a multi-scale CNN1D. Cross-domain transfer depends jointly on representation and model: tree ensembles achieve balanced accuracy of 0.84-0.93 with FlowFeatures but only 0.60-0.75 with flattened SPLT, whereas CNN1D processes the same SPLT fingerprint as a sequence and achieves the strongest transfer overall (balanced accuracy 0.98, macro F1 0.89) without any VPN data during training.
CommentsAccepted at CNSM 2026
