App Category Classification Based on Multi-Dimensional Fusion Features of Encrypted Traffic

Encrypted Traffic Classification (ETC) is essential for network management and security auditing. However, current methods frequently concentrate on single-modality feature modeling, which struggles to effectively capture the structural differences and behavioral dynamics within encrypted flows, particularly with diverse access behaviors. This presents challenges to model generalization and classification accuracy. To address this, this paper introduces XBM-DAF, a hybrid classification architecture based on structural-temporal dual-modality feature fusion, which is the first to incorporate dual attention mechanisms into an encrypted traffic multi-modal modeling framework. In the temporal modeling phase, Bi-LSTM is used to extract sliding window-level behavioral evolution features, and a Residual Self-Attention mechanism is introduced to aggregate key steps in the time series, capturing behavioral context semantics. In the cross-modal fusion phase, a Query-Guided Cross-Attention module is designed, using structural statistical features as query vectors to guide token-level dynamic weighting of LSTM outputs, enhancing the feature co-modeling capability between temporal and structural features. Finally, a multi-layer perceptron (MLP) completes high-order semantic discrimination. Comparative experiments are conducted using statistical features, temporal features, and hybrid features to validate the robustness and generalization of the model across multiple scenarios and categories. Experimental results demonstrate that XBM-DAF achieves an F1-score of 98.07% and a 62% reduction in latency on real encrypted traffic datasets, significantly outperforming existing single-modality methods, and exhibiting superior recognition capabilities and versatility in high-overlap and high-variability scenarios.