NetLexicon: Learning Discrete Behavioral Representations for Encrypted Web Traffic Analysis

2026-09-29

AI Summary

This study addresses the inadequate representation of interaction patterns in encrypted web traffic analysis by proposing a discrete pretraining framework. The method leverages vector quantization to construct a traffic vocabulary and designs two complementary pretraining objectives tailored to traffic characteristics—state transition prediction and statistical feature alignment—to learn reusable and interpretable discrete behavioral states in an unsupervised manner. Experimental results demonstrate that the proposed framework achieves a 25.5% improvement in Macro-F1 score over baseline models while accelerating fine-tuning speed by 23.6 times, thereby enabling efficient and robust encrypted traffic representation.

Abstract

Encrypted Web traffic analysis requires effective representations of observable communication behavior. Existing pretraining methods often adapt NLP/CV objectives and sequence architectures, motivating learning objectives that capture traffic-specific interaction patterns. We present NetLexicon, a discrete pretraining framework that learns reusable behavioral states from unlabeled traffic. It converts contextual traffic windows into discrete states through vector quantization, constructing a compact traffic lexicon. We design two complementary pretraining objectives. State Transition Prediction (STP) forecasts subsequent sequence structure and packet features from observed history, while Statistical Feature Alignment (SFA) grounds learned states in window-level traffic statistics. Together, they guide the lexicon to capture recurring communication behaviors and their evolution. We evaluate NetLexicon on four benchmarks covering Web application identification, service type identification, and malware detection. NetLexicon improves Macro-F1 by up to 25.5 percentage points over the strongest baseline on each benchmark and reduces fine-tuning time per epoch by up to 23.6 times relative to the evaluated baselines. Further analysis shows that the learned discrete states capture recognizable patterns in packet size, timing, and data transfer. These results demonstrate that incorporating observable behavioral structure into pretraining supports effective, efficient, and interpretable representations for encrypted traffic analysis.

Problem

• Encrypted Web traffic analysis
• Behavioral representations
• Pretraining objectives
• Traffic interaction patterns

Innovation

• Discrete Pretraining
• Vector Quantization
• Encrypted Traffic Analysis
• State Transition Prediction
• Behavioral Representations