{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T00:58:42Z","timestamp":1781225922133,"version":"3.54.1"},"reference-count":50,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100002855","name":"Ministry of Science and Technology of the People's Republic of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100002855","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2022YFB3104900"],"award-info":[{"award-number":["2022YFB3104900"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Knowledge-Based Systems"],"published-print":{"date-parts":[[2026,6]]},"DOI":"10.1016\/j.knosys.2026.116027","type":"journal-article","created":{"date-parts":[[2026,4,17]],"date-time":"2026-04-17T16:31:40Z","timestamp":1776443500000},"page":"116027","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Hierarchical traffic fingerprint-assisted Graph Neural Networks for encrypted traffic classification in Internet of Vehicles"],"prefix":"10.1016","volume":"343","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-6295-464X","authenticated-orcid":false,"given":"Yaru","family":"He","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-8573-7082","authenticated-orcid":false,"given":"Jiaqi","family":"Gao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8014-8050","authenticated-orcid":false,"given":"Daoqi","family":"Han","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3196-0349","authenticated-orcid":false,"given":"Yueming","family":"Lu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7253-9839","authenticated-orcid":false,"given":"Yaojun","family":"Qiao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"issue":"5","key":"10.1016\/j.knosys.2026.116027_b1","doi-asserted-by":"crossref","first-page":"117","DOI":"10.3390\/technologies11050117","article-title":"Connected and automated vehicles: Infrastructure, applications, security, critical challenges, and future aspects","volume":"11","author":"Sadaf","year":"2023","journal-title":"Technologies"},{"issue":"6","key":"10.1016\/j.knosys.2026.116027_b2","doi-asserted-by":"crossref","first-page":"712","DOI":"10.1109\/JPROC.2022.3173031","article-title":"6G for vehicle-to-everything (V2X) communications: Enabling technologies, challenges, and opportunities","volume":"110","author":"Noor-A-Rahim","year":"2022","journal-title":"Proc. IEEE"},{"key":"10.1016\/j.knosys.2026.116027_b3","doi-asserted-by":"crossref","DOI":"10.1016\/j.iot.2023.100809","article-title":"Security issues in Internet of Vehicles (IoV): A comprehensive survey","volume":"22","author":"Taslimasa","year":"2023","journal-title":"Internet Things"},{"key":"10.1016\/j.knosys.2026.116027_b4","series-title":"Building Secure Cars: Assuring the Automotive Software Development Lifecycle","author":"Oka","year":"2021"},{"key":"10.1016\/j.knosys.2026.116027_b5","article-title":"A survey on internet of vehicles: Applications, security issues & solutions","volume":"20","author":"Sharma","year":"2019","journal-title":"Veh. Commun."},{"issue":"1","key":"10.1016\/j.knosys.2026.116027_b6","article-title":"Machine learning technologies for secure vehicular communication in internet of vehicles: recent advances and applications","volume":"2021","author":"Ali","year":"2021","journal-title":"Secur. Commun. Networks"},{"key":"10.1016\/j.knosys.2026.116027_b7","doi-asserted-by":"crossref","first-page":"54314","DOI":"10.1109\/ACCESS.2020.2981397","article-title":"Authentication protocols in internet of vehicles: Taxonomy, analysis, and challenges","volume":"8","author":"Bagga","year":"2020","journal-title":"IEEE Access"},{"key":"10.1016\/j.knosys.2026.116027_b8","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1016\/j.comcom.2021.01.021","article-title":"Deep learning for network traffic monitoring and analysis (NTMA): A survey","volume":"170","author":"Abbasi","year":"2021","journal-title":"Comput. Commun."},{"issue":"3","key":"10.1016\/j.knosys.2026.116027_b9","doi-asserted-by":"crossref","first-page":"676","DOI":"10.1016\/j.dcan.2022.09.009","article-title":"Network traffic classification: Techniques, datasets, and challenges","volume":"10","author":"Azab","year":"2024","journal-title":"Digit. Commun. Networks"},{"issue":"1","key":"10.1016\/j.knosys.2026.116027_b10","doi-asserted-by":"crossref","first-page":"791","DOI":"10.1109\/COMST.2022.3208196","article-title":"Machine learning-powered encrypted network traffic analysis: A comprehensive survey","volume":"25","author":"Shen","year":"2023","journal-title":"IEEE Commun. Surv. & Tutorials"},{"issue":"13s","key":"10.1016\/j.knosys.2026.116027_b11","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3580522","article-title":"A survey and analysis of TLS interception mechanisms and motivations: Exploring how end-to-end TLS is made \u201cend-to-me\u201d for web traffic","volume":"55","author":"de Carn\u00e9 de Carnavalet","year":"2023","journal-title":"ACM Comput. Surv."},{"issue":"5","key":"10.1016\/j.knosys.2026.116027_b12","first-page":"1109","article-title":"Classification of encrypted traffic with second-order Markov chains and application attribute bigrams","volume":"13","author":"Li","year":"2018","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.knosys.2026.116027_b13","series-title":"2021 IFIP\/IEEE International Symposium on Integrated Network Management","first-page":"376","article-title":"Encrypted network traffic classification using a geometric learning model","author":"Huoh","year":"2021"},{"issue":"2","key":"10.1016\/j.knosys.2026.116027_b14","doi-asserted-by":"crossref","first-page":"1224","DOI":"10.1109\/TNSM.2022.3227500","article-title":"Flow-based encrypted network traffic classification with graph neural networks","volume":"20","author":"Huoh","year":"2022","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"10.1016\/j.knosys.2026.116027_b15","doi-asserted-by":"crossref","DOI":"10.1109\/TIFS.2024.3441935","article-title":"Inter-flow spatio-temporal correlation analysis based website fingerprinting using graph neural network","author":"Tan","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"issue":"3","key":"10.1016\/j.knosys.2026.116027_b16","doi-asserted-by":"crossref","first-page":"3583","DOI":"10.1109\/TNSM.2024.3383851","article-title":"MTSecurity: Privacy-preserving malicious traffic classification using graph neural network and transformer","volume":"21","author":"Yang","year":"2024","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"10.1016\/j.knosys.2026.116027_b17","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2025.111283","article-title":"MFSI: Multi-flow based service identification for encrypted network traffic","volume":"265","author":"Wang","year":"2025","journal-title":"Comput. Netw."},{"key":"10.1016\/j.knosys.2026.116027_b18","doi-asserted-by":"crossref","first-page":"2367","DOI":"10.1109\/TIFS.2021.3050608","article-title":"Accurate decentralized application identification via encrypted traffic analysis using graph neural networks","volume":"16","author":"Shen","year":"2021","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.knosys.2026.116027_b19","doi-asserted-by":"crossref","first-page":"60","DOI":"10.1016\/j.jnca.2016.09.013","article-title":"High performance traffic classification based on message size sequence and distribution","volume":"76","author":"Lu","year":"2016","journal-title":"J. Netw. Comput. Appl."},{"key":"10.1016\/j.knosys.2026.116027_b20","doi-asserted-by":"crossref","first-page":"2166","DOI":"10.1109\/TIFS.2022.3179955","article-title":"Seeing traffic paths: Encrypted traffic classification with path signature features","volume":"17","author":"Xu","year":"2022","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.knosys.2026.116027_b21","series-title":"2017 IEEE International Conference on Intelligence and Security Informatics","first-page":"43","article-title":"End-to-end encrypted traffic classification with one-dimensional convolution neural networks","author":"Wang","year":"2017"},{"key":"10.1016\/j.knosys.2026.116027_b22","series-title":"IEEE INFOCOM 2019-IEEE Conference on Computer Communications","first-page":"1171","article-title":"Fs-net: A flow sequence network for encrypted traffic classification","author":"Liu","year":"2019"},{"key":"10.1016\/j.knosys.2026.116027_b23","article-title":"DISTILLER: Encrypted traffic classification via multimodal multitask deep learning","volume":"183","author":"Aceto","year":"2021","journal-title":"J. Netw. Comput. Appl."},{"key":"10.1016\/j.knosys.2026.116027_b24","series-title":"Proceedings of the ACM Web Conference 2022","first-page":"633","article-title":"Et-bert: A contextualized datagram representation with pre-training transformers for encrypted traffic classification","author":"Lin","year":"2022"},{"key":"10.1016\/j.knosys.2026.116027_b25","article-title":"MPAF: Encrypted traffic classification with multi-phase attribute fingerprint","author":"Chen","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.knosys.2026.116027_b26","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.104134","article-title":"A graph representation framework for encrypted network traffic classification","volume":"148","author":"Okonkwo","year":"2025","journal-title":"Comput. Secur."},{"key":"10.1016\/j.knosys.2026.116027_b27","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2024.104069","article-title":"SAT-Net: A staggered attention network using graph neural networks for encrypted traffic classification","volume":"233","author":"Li","year":"2025","journal-title":"J. Netw. Comput. Appl."},{"issue":"4","key":"10.1016\/j.knosys.2026.116027_b28","doi-asserted-by":"crossref","first-page":"56","DOI":"10.1109\/SURV.2008.080406","article-title":"Network traffic classification using machine learning: A survey","volume":"10","author":"Shafiq","year":"2008","journal-title":"IEEE Commun. Surv. & Tutorials"},{"issue":"4","key":"10.1016\/j.knosys.2026.116027_b29","first-page":"95","article-title":"A survey on machine learning techniques in cognitive radios","volume":"6","author":"Salayma","year":"2017","journal-title":"Electronics"},{"key":"10.1016\/j.knosys.2026.116027_b30","series-title":"IEEE INFOCOM 2014 - IEEE Conference on Computer Communications","first-page":"781","article-title":"Markov chain fingerprinting to classify encrypted traffic","author":"Korczy\u0144ski","year":"2014"},{"key":"10.1016\/j.knosys.2026.116027_b31","article-title":"Performance evaluation of secured network traffic classification using a machine learning approach","volume":"78","author":"Afeez Ajani Afuwape","year":"2021","journal-title":"Comput. Stand. Interfaces"},{"key":"10.1016\/j.knosys.2026.116027_b32","doi-asserted-by":"crossref","unstructured":"O. Barut, R. Zhu, Y. Luo, T. Zhang, TLS encrypted application classification using machine learning with flow feature engineering, in: Proceedings of the 2020 10th International Conference on Communication and Network Security, 2020, pp. 32\u201341.","DOI":"10.1145\/3442520.3442529"},{"issue":"4","key":"10.1016\/j.knosys.2026.116027_b33","doi-asserted-by":"crossref","first-page":"3746","DOI":"10.1109\/TVT.2021.3063738","article-title":"Sequential message characterization for early classification of encrypted internet traffic","volume":"70","author":"Chen","year":"2021","journal-title":"IEEE Trans. Veh. Technol."},{"issue":"5","key":"10.1016\/j.knosys.2026.116027_b34","doi-asserted-by":"crossref","first-page":"76","DOI":"10.1109\/MCOM.2019.1800819","article-title":"Deep learning for encrypted traffic classification: An overview","volume":"57","author":"Rezaei","year":"2019","journal-title":"IEEE Commun. Mag."},{"issue":"2","key":"10.1016\/j.knosys.2026.116027_b35","doi-asserted-by":"crossref","first-page":"109","DOI":"10.1109\/TAI.2021.3076021","article-title":"Graph learning: A survey","volume":"2","author":"Xia","year":"2021","journal-title":"IEEE Trans. Artif. Intell."},{"key":"10.1016\/j.knosys.2026.116027_b36","series-title":"Graph attention networks","author":"Veli\u010dkovi\u0107","year":"2017"},{"key":"10.1016\/j.knosys.2026.116027_b37","article-title":"Inductive representation learning on large graphs","volume":"30","author":"Hamilton","year":"2017","journal-title":"Adv. Neural Inf. Process. Syst."},{"issue":"21","key":"10.1016\/j.knosys.2026.116027_b38","doi-asserted-by":"crossref","first-page":"4222","DOI":"10.3390\/electronics13214222","article-title":"L-GraphSAGE: A graph neural network-based approach for IoV application encrypted traffic identification","volume":"13","author":"Zhang","year":"2024","journal-title":"Electronics"},{"key":"10.1016\/j.knosys.2026.116027_b39","series-title":"CGNN: traffic classification with graph neural network","author":"Pang","year":"2021"},{"issue":"1","key":"10.1016\/j.knosys.2026.116027_b40","article-title":"Unleashing the power of SDN and GNN for network anomaly detection: State-of-the-art, challenges, and future directions","volume":"7","author":"Dhadhania","year":"2024","journal-title":"Secur. Priv."},{"issue":"2","key":"10.1016\/j.knosys.2026.116027_b41","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3570906","article-title":"Graph learning for anomaly analytics: Algorithms, applications, and challenges","volume":"14","author":"Ren","year":"2023","journal-title":"ACM Trans. Intell. Syst. Technol."},{"key":"10.1016\/j.knosys.2026.116027_b42","first-page":"1362","article-title":"Revisiting heterophily for graph neural networks","volume":"35","author":"Luan","year":"2022","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"10.1016\/j.knosys.2026.116027_b43","series-title":"The heterophilic graph learning handbook: Benchmarks, models, theoretical analysis, applications and challenges","author":"Luan","year":"2024"},{"key":"10.1016\/j.knosys.2026.116027_b44","article-title":"Universal invariant and equivariant graph neural networks","volume":"32","author":"Keriven","year":"2019","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"10.1016\/j.knosys.2026.116027_b45","series-title":"2022 19th Annual International Conference on Privacy, Security & Trust","first-page":"1","article-title":"Towards the development of a realistic multidimensional IoT profiling dataset","author":"Dadkhah","year":"2022"},{"key":"10.1016\/j.knosys.2026.116027_b46","series-title":"The ACM on Web Conference","first-page":"3908","article-title":"Facing anomalies head-on: Network traffic anomaly detection via uncertainty-inspired inter-sample differences","author":"Lian","year":"2025"},{"key":"10.1016\/j.knosys.2026.116027_b47","doi-asserted-by":"crossref","DOI":"10.1016\/j.patcog.2024.111215","article-title":"Semi-supervised anomaly traffic detection via multi-frequency reconstruction","volume":"161","author":"Lian","year":"2025","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.knosys.2026.116027_b48","series-title":"Externally validating the IoTDevID device identification methodology using the CIC IoT 2022 dataset","author":"Kostas","year":"2023"},{"key":"10.1016\/j.knosys.2026.116027_b49","doi-asserted-by":"crossref","DOI":"10.1016\/j.patcog.2024.111215","article-title":"Semi-supervised anomaly traffic detection via multi-frequency reconstruction","volume":"161","author":"Lian","year":"2025","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.knosys.2026.116027_b50","doi-asserted-by":"crossref","first-page":"1273","DOI":"10.1109\/TIFS.2026.3655514","article-title":"Contextual masking distillation for network traffic anomaly detection","volume":"21","author":"Lian","year":"2026","journal-title":"IEEE Trans. Inf. Forensics Secur."}],"container-title":["Knowledge-Based Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0950705126007537?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0950705126007537?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T00:09:28Z","timestamp":1781222968000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0950705126007537"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6]]},"references-count":50,"alternative-id":["S0950705126007537"],"URL":"https:\/\/doi.org\/10.1016\/j.knosys.2026.116027","relation":{},"ISSN":["0950-7051"],"issn-type":[{"value":"0950-7051","type":"print"}],"subject":[],"published":{"date-parts":[[2026,6]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Hierarchical traffic fingerprint-assisted Graph Neural Networks for encrypted traffic classification in Internet of Vehicles","name":"articletitle","label":"Article Title"},{"value":"Knowledge-Based Systems","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.knosys.2026.116027","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"116027"}}