{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,25]],"date-time":"2025-10-25T03:23:29Z","timestamp":1761362609255,"version":"build-2065373602"},"reference-count":33,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2025,10,25]],"date-time":"2025-10-25T00:00:00Z","timestamp":1761350400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,10,25]],"date-time":"2025-10-25T00:00:00Z","timestamp":1761350400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100012401","name":"Beijing Science and Technology Planning Project","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100012401","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>With the growing concerns for user privacy and communication security, the volume of encrypted traffic has surged, making accurate classification of encrypted traffic crucial. Current mainstream classification methods primarily rely on handcrafted features and machine learning techniques. However, these features often depend on expert knowledge and require substantial human resources. Additionally, using simple features can lead to inadequate feature extraction. To address these challenges, we have developed the Pulse-Driven Quad-Directional Temporal Convolutional Network. A core innovation of this model is transforming one-dimensional packet length sequences into two-dimensional pulse sequences, significantly enhancing the feature representation capability and classification accuracy of the model. Furthermore, the model employs forward, backward, middle-outward, and both-ends-inward temporal convolutions to effectively extract global features. Coupled with the self-attention mechanism, the model deeply explores the dependencies among features, greatly enhancing classification accuracy and robustness. On the public CESNET-TLS22 dataset, this method achieved an F1 score of 99.24% in the classification of five application services and an average F1 score of 98.74% in the 20-application classification test. Additionally, on the UNB ISCX dataset, tests on VPN and Tor traffic also demonstrated outstanding performance, with F1 scores exceeding 98%. These results highlight the precision and effectiveness of this method across various application scenarios.<\/jats:p>","DOI":"10.1186\/s42400-025-00386-1","type":"journal-article","created":{"date-parts":[[2025,10,25]],"date-time":"2025-10-25T03:02:31Z","timestamp":1761361351000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Classifying encrypted traffic using quad-directional convolution on pulse sequences"],"prefix":"10.1186","volume":"8","author":[{"given":"Chenxu","family":"Pei","sequence":"first","affiliation":[]},{"given":"Huiying","family":"Du","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9687-1377","authenticated-orcid":false,"given":"Xuan","family":"Sun","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,10,25]]},"reference":[{"issue":"2","key":"386_CR1","doi-asserted-by":"publisher","first-page":"100","DOI":"10.1109\/MNET.001.1900091","volume":"34","author":"G Aceto","year":"2020","unstructured":"Aceto G, Ciuonzo D, Montieri A, Pescap\u00e9 A (2020) The challenge of encrypted traffic classification: from research to practical management. IEEE Netw. 34(2):100\u2013108. https:\/\/doi.org\/10.1109\/MNET.001.1900091","journal-title":"IEEE Netw."},{"key":"386_CR2","doi-asserted-by":"publisher","first-page":"239","DOI":"10.1016\/j.procs.2021.05.025","volume":"185","author":"L Ashiku","year":"2021","unstructured":"Ashiku L, Dagli C (2021) Network intrusion detection system using deep learning. Procedia Comput Sci 185:239\u2013247. https:\/\/doi.org\/10.1016\/j.procs.2021.05.025","journal-title":"Procedia Comput Sci"},{"key":"386_CR3","doi-asserted-by":"publisher","first-page":"321","DOI":"10.1613\/jair.953","volume":"16","author":"NV Chawla","year":"2002","unstructured":"Chawla NV, Bowyer KW, Hall LO, Kegelmeyer WP (2002) SMOTE: synthetic minority over-sampling technique. J Artif Intell Res 16:321\u2013357","journal-title":"J Artif Intell Res"},{"doi-asserted-by":"crossref","unstructured":"Draper-Gil G, Lashkari AH, Mamun MSI, et al. (2016) Characterization of encrypted and VPN traffic using time-related features. In: Proceedings of the 2nd international conference on information systems security and privacy (ICISSP 2016), SciTePress, pp 407-414","key":"386_CR4","DOI":"10.5220\/0005740704070414"},{"unstructured":"Dr\u00e1pal L, \u010celeda P (2022) CESNET-TLS22: A dataset for fine-grained classification of encrypted traffic. In: Proceedings of the 14th international conference on communication systems & networks (COMSNETS 2022), pp 171-178","key":"386_CR5"},{"unstructured":"Gil D, Ferrer G, Garc\u00eda R (2017) Tor traffic analysis and detection using time-related features. In: Proceedings of the 2nd international conference on information systems security and privacy (ICISSP), SciTePress, pp 253-260","key":"386_CR6"},{"key":"386_CR7","doi-asserted-by":"publisher","DOI":"10.1016\/j.eij.2024.100475","author":"H Hong","year":"2024","unstructured":"Hong H, Ye L, Zhou S, Zhang X, Zelia Z (2024) CoTNeT: contextual transformer networks for encrypted traffic classification. J Inf Secur Appl. https:\/\/doi.org\/10.1016\/j.eij.2024.100475","journal-title":"J Inf Secur Appl"},{"doi-asserted-by":"crossref","unstructured":"Huang H, Lu Y, Zhou S, Zhang X, Li Z (2024) CoTNeT: Contextual transformer network for encrypted traffic classification. Egyptian Informatics Journal 26: 100475. Available at: https:\/\/doi.org\/10.1016\/j.eij.2024.100475","key":"386_CR8","DOI":"10.1016\/j.eij.2024.100475"},{"unstructured":"Information Security Centre of Excellence (ISCX) (2016) ISCX VPN-NonVPN 2016 dataset. University of New Brunswick","key":"386_CR9"},{"doi-asserted-by":"publisher","unstructured":"Jiang W, Hong Y, Zhou B, He X (2020) Time series encodings with temporal convolutional networks. In: Proceedings of the european conference on artificial intelligence (ECAI), Springer, pp 342-354. https:\/\/doi.org\/10.1007\/978-3-030-30490-4_56","key":"386_CR10","DOI":"10.1007\/978-3-030-30490-4_56"},{"doi-asserted-by":"crossref","unstructured":"Kim S, Eldele E (2021) TS-TCC: Time series representation learning via temporal contrastive coding. arXiv preprint arXiv:2106.09327. Accessed 15 Dec 2023","key":"386_CR11","DOI":"10.24963\/ijcai.2021\/324"},{"doi-asserted-by":"publisher","unstructured":"Korczynski M, Duda A (2014) Markov chain fingerprinting to classify encrypted traffic. In: Proceedings of the IEEE international conference on communications (ICC), IEEE, pp 1922-1927. https:\/\/doi.org\/10.1109\/ICC.2014.6883519","key":"386_CR12","DOI":"10.1109\/ICC.2014.6883519"},{"doi-asserted-by":"publisher","unstructured":"Liu C, Cao Z, Xiong G, Gou G, Yiu SM, He L (2018) MaMPF: Encrypted traffic classification based on multi-attribute Markov probability fingerprints. In: 2018 IEEE\/ACM 26th international symposium on quality of service (IWQoS), IEEE, pp 1-10. https:\/\/doi.org\/10.1109\/IWQoS.2018.8624183","key":"386_CR13","DOI":"10.1109\/IWQoS.2018.8624183"},{"doi-asserted-by":"publisher","unstructured":"Liu C, He L, Xiong G, Cao Z, Li Z (2019) FS-Net: A flow sequence network for encrypted traffic classification. In: IEEE Conference on Computer Communications (INFOCOM), IEEE, pp 1171-1179. https:\/\/doi.org\/10.1109\/INFOCOM.2019.8737507","key":"386_CR14","DOI":"10.1109\/INFOCOM.2019.8737507"},{"key":"386_CR15","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2023.100519","author":"P Luo","year":"2023","unstructured":"Luo P, Chu J, Yang G (2023) A novel multimodal deep learning framework for encrypted traffic classification. J Inf Secur Appl. https:\/\/doi.org\/10.1016\/j.jisa.2023.100519","journal-title":"J Inf Secur Appl"},{"key":"386_CR16","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2023.103519","author":"P Luo","year":"2023","unstructured":"Luo P, Chu J, Yang G (2023) Using lightweight feature engineering for machine learning-based IP packet-level encrypted traffic classification. J Inf Secur Appl. https:\/\/doi.org\/10.1016\/j.jisa.2023.103519","journal-title":"J Inf Secur Appl"},{"unstructured":"National Institute of Justice (2024) Taking on the dark web: Law enforcement experts ID investigative needs. Available at: https:\/\/nij.ojp.gov. Accessed 12 June 2024","key":"386_CR17"},{"unstructured":"Palo Alto Networks (2023) What is unidirectional and bidirectional NetFlow? Available at: https:\/\/knowledgebase.paloaltonetworks.com. Accessed 25 May 2024","key":"386_CR18"},{"unstructured":"Programming Empire (2022) Measuring performance of classification using confusion matrix. Available at: https:\/\/programmingempire.com. Accessed 20 July 2023","key":"386_CR19"},{"doi-asserted-by":"publisher","unstructured":"Rachmawati SM, Kim DS, Lee JM (2021) Machine learning algorithm in network traffic classification. In: 2021 International conference on information and communication technology convergence (ICTC), IEEE, pp 1-6. https:\/\/doi.org\/10.1109\/ICTC52510.2021.9620746","key":"386_CR20","DOI":"10.1109\/ICTC52510.2021.9620746"},{"key":"386_CR21","volume-title":"IP address management","author":"T Rooney","year":"2021","unstructured":"Rooney T, Dooley M (2021) IP address management. Wiley-IEEE Press, New York"},{"unstructured":"Sandler M, Howard A, Zhu M, Zhmoginov A, Chen LC (2020) Do we need fully connected output layers in convolutional networks? arXiv preprint arXiv:2004.13587. Accessed 20 Jan 2024","key":"386_CR22"},{"doi-asserted-by":"crossref","unstructured":"Shi Z, Luktarhan N, Song Y, Tian G (2023) BFCN: A Novel Classification Method of Encrypted Traffic Based on BERT and CNN. Electronics 12(3): 516. Available at: https:\/\/doi.org\/10.3390\/electronics12030516","key":"386_CR23","DOI":"10.3390\/electronics12030516"},{"issue":"1","key":"386_CR24","doi-asserted-by":"publisher","first-page":"152","DOI":"10.3390\/electronics12010152","volume":"12","author":"M Tavakoli","year":"2023","unstructured":"Tavakoli M, Shamsi P, Homayoun H (2023) Zero-trust marine cyberdefense for IoT-based communications: an explainable approach. Electronics 12(1):152. https:\/\/doi.org\/10.3390\/electronics12010152","journal-title":"Electronics"},{"key":"386_CR25","doi-asserted-by":"publisher","first-page":"47","DOI":"10.1016\/j.neunet.2018.12.002","volume":"111","author":"A Tavanaei","year":"2019","unstructured":"Tavanaei A, Ghodrati M, Kheradpisheh SR, Masquelier T, Maida A (2019) Deep learning in spiking neural networks. Neural Netw 111:47\u201363","journal-title":"Neural Netw"},{"key":"386_CR26","first-page":"5998","volume":"30","author":"A Vaswani","year":"2017","unstructured":"Vaswani A, Shazeer N, Parmar N, Uszkoreit J, Jones L, Gomez AN et al (2017) Attention is all you need. Adv Neural Inf Process Syst 30:5998\u20136008","journal-title":"Adv Neural Inf Process Syst"},{"unstructured":"W3Techs (2024) Usage statistics of default protocol https for websites.https:\/\/w3techs.com\/technologies\/details\/ce-httpsdefault","key":"386_CR27"},{"key":"386_CR28","doi-asserted-by":"publisher","first-page":"52310","DOI":"10.1109\/ACCESS.2021.3119958","volume":"9","author":"X Wang","year":"2021","unstructured":"Wang X, Wang X, Jin L, Lv R, Dai B, He M, Lv T (2021) Network traffic classification techniques: a review. IEEE Access 9:52310\u201352325. https:\/\/doi.org\/10.1109\/ACCESS.2021.3119958","journal-title":"IEEE Access"},{"doi-asserted-by":"crossref","unstructured":"Wang W, Zhu M, Wang J, Zeng X, Yang Z (2017) End-to-end encrypted traffic classification with one-dimensional convolution neural networks. In: 2017 IEEE international conference on intelligence and security informatics (ISI), IEEE, pp 43-48","key":"386_CR29","DOI":"10.1109\/ISI.2017.8004872"},{"doi-asserted-by":"crossref","unstructured":"Wei W, Zhang M, Qu H, Belatreche A, Zhang J, Chen H (2023) Temporal-coded spiking neural networks with dynamic firing threshold: Learning with event-driven backpropagation. In: Proceedings of the IEEE\/CVF international conference on computer vision (ICCV), IEEE, pp 10552-10562","key":"386_CR30","DOI":"10.1109\/ICCV51070.2023.00968"},{"unstructured":"Xie R, Cao J, Dong E, Xu M, Sun K, Li Q, Shen L, Zhang M (2023) Rosetta: Enabling robust TLS encrypted traffic classification in diverse network environments with TCP-aware traffic augmentation. In: Proceedings of the 32nd USENIX security symposium, Anaheim, CA, USA: USENIX Association, pp. 625-635. Available at: https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/xie","key":"386_CR31"},{"unstructured":"Zerveas G, Jayaraman S, Patel D, Bhamidipaty A, Eickhoff C (2023) A time series is worth 64 words: Long-term forecasting with transformers. arXiv preprint arXiv:2211.14730. Available at: https:\/\/arxiv.org\/abs\/2211.14730. Accessed 10 Oct 2023","key":"386_CR32"},{"doi-asserted-by":"crossref","unstructured":"Zou Z, Ge JG, Zheng HB, et al. (2018) Encrypted traffic classification with a convolutional long short-term memory neural network. In: 2018 IEEE 20th international conference on high performance computing and communications; ieee 16th international conference on smart city; IEEE 4th international conference on data science and systems (HPCC\/SmartCity\/DSS), IEEE, pp 329-334","key":"386_CR33","DOI":"10.1109\/HPCC\/SmartCity\/DSS.2018.00074"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00386-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-025-00386-1\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00386-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,25]],"date-time":"2025-10-25T03:02:40Z","timestamp":1761361360000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-025-00386-1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,25]]},"references-count":33,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,12]]}},"alternative-id":["386"],"URL":"https:\/\/doi.org\/10.1186\/s42400-025-00386-1","relation":{},"ISSN":["2523-3246"],"issn-type":[{"type":"electronic","value":"2523-3246"}],"subject":[],"published":{"date-parts":[[2025,10,25]]},"assertion":[{"value":"23 October 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"20 February 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"25 October 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval and consent to participate"}},{"value":"All authors consent to the publication of this manuscript.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}},{"value":"The authors, Chenxu Pei, Huiying Du, and Xuan Sun, declare that there are no conflict of interest related to this work.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"79"}}