{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,13]],"date-time":"2026-01-13T12:13:50Z","timestamp":1768306430233,"version":"3.49.0"},"publisher-location":"Singapore","reference-count":28,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819530007","type":"print"},{"value":"9789819530014","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,11,17]],"date-time":"2025-11-17T00:00:00Z","timestamp":1763337600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,11,17]],"date-time":"2025-11-17T00:00:00Z","timestamp":1763337600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-981-95-3001-4_26","type":"book-chapter","created":{"date-parts":[[2025,11,16]],"date-time":"2025-11-16T19:42:24Z","timestamp":1763322144000},"page":"352-363","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["GSC-SAGE: A Generative Subgraph Contrastive Framework for\u00a0Encrypted Traffic Detection"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-5522-0655","authenticated-orcid":false,"given":"Hongyuan","family":"Cheng","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-5578-7350","authenticated-orcid":false,"given":"Weizhe","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhiguang","family":"Yan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Weixiang","family":"Jiang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dexin","family":"Zhu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lihua","family":"Yin","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,11,17]]},"reference":[{"key":"26_CR1","unstructured":"Ixia Breakpoint Overview and Specifications. https:\/\/www.ixiacom.com\/products\/breakingpoint (2016). Accessed 03 Mar 2025"},{"key":"26_CR2","unstructured":"HTTPS Encryption in Chrome. https:\/\/transparencyreport.google.com\/https\/overview?hl=En (2024). Accessed 21 Apr 2024"},{"key":"26_CR3","doi-asserted-by":"publisher","unstructured":"Anderson, B., McGrew, D.: Identifying encrypted malware traffic with contextual flow data. In: Proceedings of the 2016 ACM Workshop on Artificial Intelligence and Security, pp. 35\u201346. AISec \u201916, Association for Computing Machinery, New York, NY, USA (2016). https:\/\/doi.org\/10.1145\/2996758.2996768","DOI":"10.1145\/2996758.2996768"},{"key":"26_CR4","doi-asserted-by":"publisher","unstructured":"Anderson, B., McGrew, D.: Machine learning for encrypted malware traffic classification: accounting for noisy labels and non-stationarity. In: Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 1723\u20131732. KDD \u201917, Association for Computing Machinery, New York, NY, USA (2017). https:\/\/doi.org\/10.1145\/3097983.3098163","DOI":"10.1145\/3097983.3098163"},{"key":"26_CR5","doi-asserted-by":"publisher","first-page":"195","DOI":"10.1007\/s11416-017-0306-6","volume":"14","author":"B Anderson","year":"2018","unstructured":"Anderson, B., Paul, S., McGrew, D.: Deciphering malware\u2019s use of TLS (without decryption). J. Comput. Virol. Hacking Tech. 14, 195\u2013211 (2018)","journal-title":"J. Comput. Virol. Hacking Tech."},{"key":"26_CR6","doi-asserted-by":"publisher","unstructured":"Bazuhair, W., Lee, W.: Detecting malign encrypted network traffic using Perlin noise and convolutional neural network. In: 2020 10th Annual Computing and Communication Workshop and Conference (CCWC), pp. 0200\u20130206 (2020). https:\/\/doi.org\/10.1109\/CCWC47524.2020.9031116","DOI":"10.1109\/CCWC47524.2020.9031116"},{"key":"26_CR7","unstructured":"Chang, L., Branco, P.: Graph-based solutions with residuals for intrusion detection: The modified E-GraphSAGE and E-ResGAT algorithms. arXiv preprint arXiv:2111.13597 (2021)"},{"issue":"4","key":"26_CR8","doi-asserted-by":"publisher","first-page":"807","DOI":"10.1109\/TC.2013.13","volume":"63","author":"G Creech","year":"2014","unstructured":"Creech, G., Hu, J.: A semantic approach to host-based intrusion detection systems using contiguousand discontiguous system call patterns. IEEE Trans. Comput. 63(4), 807\u2013819 (2014). https:\/\/doi.org\/10.1109\/TC.2013.13","journal-title":"IEEE Trans. Comput."},{"key":"26_CR9","unstructured":"Cui, T., Gou, G., Xiong, G., Li, Z., Cui, M., Liu, C.: SiamHAN: IPv6 address correlation attacks on TLS encrypted traffic via Siamese heterogeneous graph attention network. In: 30th USENIX Security Symposium (USENIX Security 21), pp. 4329\u20134346. USENIX Association (2021). https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/cui"},{"issue":"1","key":"26_CR10","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1186\/s40537-023-00876-4","volume":"11","author":"B Khemani","year":"2024","unstructured":"Khemani, B., Patil, S., Kotecha, K., Tanwar, S.: A review of graph neural networks: concepts, architectures, techniques, challenges, datasets, applications, and future directions. J. Big Data 11(1), 18 (2024)","journal-title":"J. Big Data"},{"key":"26_CR11","unstructured":"Lashkari, A.H., Gil, G.D., Mamun, M.S.I., Ghorbani, A.A.: Characterization of tor traffic using time based features. In: International Conference on Information Systems Security and Privacy. vol.\u00a02, pp. 253\u2013262. SciTePress (2017)"},{"key":"26_CR12","doi-asserted-by":"publisher","unstructured":"Lin, K., Xu, X., Gao, H.: TSCRNN: a novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of IIoT. Comput. Netw. 190, 107974 (2021). https:\/\/doi.org\/10.1016\/j.comnet.2021.107974, https:\/\/www.sciencedirect.com\/science\/article\/pii\/S1389128621001067","DOI":"10.1016\/j.comnet.2021.107974"},{"key":"26_CR13","doi-asserted-by":"publisher","unstructured":"Lo, W.W., Layeghy, S., Sarhan, M., Gallagher, M., Portmann, M.: E-GraphSAGE: a graph neural network based intrusion detection system for IoT. In: NOMS 2022-2022 IEEE\/IFIP Network Operations and Management Symposium, pp.\u00a01\u20139. IEEE Press (2022). https:\/\/doi.org\/10.1109\/NOMS54207.2022.9789878","DOI":"10.1109\/NOMS54207.2022.9789878"},{"key":"26_CR14","doi-asserted-by":"crossref","unstructured":"MontazeriShatoori, M., Davidson, L., Kaur, G., Lashkari, A.H.: Detection of DoH tunnels using time-series classification of encrypted traffic. In: 2020 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC\/PiCom\/CBDCom\/CyberSciTech), pp. 63\u201370 (2020). https:\/\/api.semanticscholar.org\/CorpusID:226852987","DOI":"10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00026"},{"key":"26_CR15","doi-asserted-by":"publisher","unstructured":"Pham, T.D., Ho, T.L., Truong-Huu, T., Cao, T.D., Truong, H.L.: MAppGraph: mobile-app classification on encrypted network traffic using deep graph convolution neural networks. In: Proceedings of the 37th Annual Computer Security Applications Conference, pp. 1025\u20131038. ACSAC \u201921, Association for Computing Machinery, New York, NY, USA (2021). https:\/\/doi.org\/10.1145\/3485832.3485925","DOI":"10.1145\/3485832.3485925"},{"issue":"2","key":"26_CR16","doi-asserted-by":"publisher","first-page":"1218","DOI":"10.1109\/TNSM.2021.3071441","volume":"18","author":"T Shapira","year":"2021","unstructured":"Shapira, T., Shavitt, Y.: FlowPic: a generic representation for encrypted traffic classification and applications identification. IEEE Trans. Netw. Serv. Manage. 18(2), 1218\u20131232 (2021). https:\/\/doi.org\/10.1109\/TNSM.2021.3071441","journal-title":"IEEE Trans. Netw. Serv. Manage."},{"key":"26_CR17","doi-asserted-by":"publisher","unstructured":"Shen, M., Zhang, J., Zhu, L., Xu, K., Du, X.: Accurate decentralized application identification via encrypted traffic analysis using graph neural networks. IEEE Trans. Inf. Forensics Secur. 16, 2367\u20132380 (2021). https:\/\/doi.org\/10.1109\/TIFS.2021.3050608","DOI":"10.1109\/TIFS.2021.3050608"},{"key":"26_CR18","doi-asserted-by":"publisher","unstructured":"Sirinam, P., Imani, M., Juarez, M., Wright, M.: Deep fingerprinting: undermining website fingerprinting defenses with deep learning. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 1928\u20131943. CCS \u201918, Association for Computing Machinery, New York, NY, USA (2018). https:\/\/doi.org\/10.1145\/3243734.3243768","DOI":"10.1145\/3243734.3243768"},{"issue":"1","key":"26_CR19","doi-asserted-by":"publisher","first-page":"63","DOI":"10.1109\/TIFS.2017.2737970","volume":"13","author":"VF Taylor","year":"2018","unstructured":"Taylor, V.F., Spolaor, R., Conti, M., Martinovic, I.: Robust smartphone app identification via encrypted network traffic analysis. IEEE Trans. Inf. Forensics Secur. 13(1), 63\u201378 (2018). https:\/\/doi.org\/10.1109\/TIFS.2017.2737970","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"26_CR20","doi-asserted-by":"crossref","unstructured":"Van\u00a0Ede, T., et al.: FlowPrint: semi-supervised mobile-app fingerprinting on encrypted network traffic. In: Network and Distributed System Security Symposium (NDSS). vol.\u00a027 (2020)","DOI":"10.14722\/ndss.2020.24412"},{"issue":"7","key":"26_CR21","doi-asserted-by":"publisher","first-page":"6295","DOI":"10.1007\/s10462-022-10321-2","volume":"56","author":"L Waikhom","year":"2023","unstructured":"Waikhom, L., Patgiri, R.: A survey of graph neural networks in various learning paradigms: methods, applications, and challenges. Artif. Intell. Rev. 56(7), 6295\u20136364 (2023)","journal-title":"Artif. Intell. Rev."},{"key":"26_CR22","doi-asserted-by":"publisher","unstructured":"Wang, W., Shang, Y., He, Y., Li, Y., Liu, J.: BotMark: automated botnet detection with hybrid analysis of flow-based and graph-based traffic behaviors. Inf. Sci. 511, 284\u2013296 (2020). https:\/\/doi.org\/10.1016\/j.ins.2019.09.024. https:\/\/www.sciencedirect.com\/science\/article\/pii\/S0020025519308758","DOI":"10.1016\/j.ins.2019.09.024"},{"key":"26_CR23","doi-asserted-by":"publisher","unstructured":"Wang, W., Zhu, M., Wang, J., Zeng, X., Yang, Z.: End-to-end encrypted traffic classification with one-dimensional convolution neural networks. In: 2017 IEEE International Conference on Intelligence and Security Informatics (ISI), pp. 43\u201348 (2017). https:\/\/doi.org\/10.1109\/ISI.2017.8004872","DOI":"10.1109\/ISI.2017.8004872"},{"key":"26_CR24","doi-asserted-by":"publisher","unstructured":"Wang, W., Zhu, M., Zeng, X., Ye, X., Sheng, Y.: Malware traffic classification using convolutional neural network for representation learning. In: 2017 International Conference on Information Networking (ICOIN), pp. 712\u2013717 (2017). https:\/\/doi.org\/10.1109\/ICOIN.2017.7899588","DOI":"10.1109\/ICOIN.2017.7899588"},{"key":"26_CR25","doi-asserted-by":"publisher","unstructured":"Xiao, Q., Liu, J., Wang, Q., Jiang, Z., Wang, X., Yao, Y.: Towards network anomaly detection using graph embedding. In: Krzhizhanovskaya, V.V., et al. (eds.) ICCS 2020. LNCS, vol. 12140, pp. 156\u2013169. Springer, Cham (2020). https:\/\/doi.org\/10.1007\/978-3-030-50423-6_12","DOI":"10.1007\/978-3-030-50423-6_12"},{"issue":"4","key":"26_CR26","doi-asserted-by":"publisher","first-page":"2991","DOI":"10.1109\/COMST.2016.2566669","volume":"18","author":"C Xu","year":"2016","unstructured":"Xu, C., Chen, S., Su, J., Yiu, S.M., Hui, L.C.K.: A survey on regular expression matching for deep packet inspection: applications, algorithms, and hardware platforms. IEEE Commun. Surv. Tutorials 18(4), 2991\u20133029 (2016). https:\/\/doi.org\/10.1109\/COMST.2016.2566669","journal-title":"IEEE Commun. Surv. Tutorials"},{"key":"26_CR27","doi-asserted-by":"publisher","first-page":"66","DOI":"10.1007\/978-3-030-94029-4_5","volume-title":"Cyberspace Safety and Security","author":"B Zhang","year":"2022","unstructured":"Zhang, B., Li, J., Chen, C., Lee, K., Lee, I.: A practical botnet traffic detection system using GNN. In: Meng, W., Conti, M. (eds.) Cyberspace Safety and Security, pp. 66\u201378. Springer International Publishing, Cham (2022)"},{"key":"26_CR28","doi-asserted-by":"publisher","unstructured":"Zhang, H., Papadopoulos, C., Massey, D.: Detecting encrypted botnet traffic. In: 2013 Proceedings IEEE INFOCOM, pp. 3453\u20131358 (2013). https:\/\/doi.org\/10.1109\/INFCOM.2013.6567180","DOI":"10.1109\/INFCOM.2013.6567180"}],"container-title":["Lecture Notes in Computer Science","Knowledge Science, Engineering and Management"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-95-3001-4_26","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,13]],"date-time":"2026-01-13T05:37:24Z","timestamp":1768282644000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-95-3001-4_26"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,17]]},"ISBN":["9789819530007","9789819530014"],"references-count":28,"URL":"https:\/\/doi.org\/10.1007\/978-981-95-3001-4_26","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,11,17]]},"assertion":[{"value":"17 November 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"KSEM","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Knowledge Science, Engineering and Management","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Macao","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"China","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"4 August 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"7 August 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"18","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"ksem2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/ksem2025.scimeeting.cn\/en\/web\/index\/27434","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}