发表机构
Beijing University of Posts and Telecommunications; Zhongguancun Laboratory（北京邮电大学; 中关村实验室）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
针对混合加密流量中多标签网站指纹识别难题，提出FlowAtom方法，利用无标签流量预训练流编码器并聚合原子证据，在封闭和开放世界评估中均优于基线。
AI 中文摘要
在混合加密流量中识别受监控网站集合具有挑战性，因为单个流通常仅提供网站身份的部分证据。为应对这一挑战，我们提出了FlowAtom，它无需网站标签即可从流表示中构建共享原型，称为原子。具体而言，FlowAtom在外部未标记流量上预训练流编码器，并在每个观测窗口内将跨流的原子响应聚合为固定维度、排列不变的表示，用于受监控网站集合预测。在直接HTTPS、Trojan和VMess场景下，FlowAtom在封闭世界评估中分别取得了97.82%、94.43%和93.92%的微F1分数，并且在包含受监控访问的窗口上的开放世界评估中持续优于所评估的基线方法。代码可在该https URL获取。
英文摘要
Identifying the set of monitored websites in mixed encrypted traffic is challenging because an individual flow often provides only partial evidence of website identity. To address this challenge, we propose FlowAtom, which constructs shared prototypes, called Atoms, from flow representations without website labels. Specifically, FlowAtom pretrains a flow encoder on external unlabeled traffic and aggregates Atom responses across flows within each observation window into a fixed-dimensional, permutation-invariant representation for monitored website-set prediction. Across Direct HTTPS, Trojan, and VMess, FlowAtom achieves micro-F1 scores of 97.82%, 94.43%, and 93.92% in closed-world evaluation, respectively, and consistently outperforms the evaluated baselines in open-world evaluation on windows containing monitored visits. The code is available at https://github.com/aimafan123/FlowAtom.
Comments5 pages. Submitted to ICASSP 2027
