{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T01:39:08Z","timestamp":1760060348541,"version":"build-2065373602"},"reference-count":47,"publisher":"MDPI AG","issue":"8","license":[{"start":{"date-parts":[[2025,8,21]],"date-time":"2025-08-21T00:00:00Z","timestamp":1755734400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372124"],"award-info":[{"award-number":["62372124"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["BDCC"],"abstract":"<jats:p>Mobile traffic classification serves as a fundamental component in network security systems. In recent years, pre-training methods have significantly advanced this field. However, as mobile traffic is typically mixed with third-party services, the deep integration of such shared services results in highly similar TCP flow characteristics across different applications. This makes it challenging for existing traffic classification methods to effectively identify mobile traffic. To address the challenge, we propose MS-PreTE, a two-phase pre-training framework for mobile traffic classification. MS-PreTE introduces a novel multi-level representation model to preserve traffic information from diverse perspectives and hierarchical levels. Furthermore, MS-PreTE incorporates a focal-attention mechanism to enhance the model\u2019s capability in discerning subtle differences among similar traffic flows. Evaluations demonstrate that MS-PreTE achieves state-of-the-art performance on three mobile application datasets, boosting the F1 score for Cross-platform (iOS) to 99.34% (up by 2.1%), Cross-platform (Android) to 98.61% (up by 1.6%), and NUDT-Mobile-Traffic to 87.70% (up by 2.47%). Moreover, MS-PreTE exhibits strong generalization capabilities across four real-world traffic datasets.<\/jats:p>","DOI":"10.3390\/bdcc9080216","type":"journal-article","created":{"date-parts":[[2025,8,21]],"date-time":"2025-08-21T08:02:44Z","timestamp":1755763364000},"page":"216","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["MS-PreTE: A Multi-Scale Pre-Training Encoder for Mobile Encrypted Traffic Classification"],"prefix":"10.3390","volume":"9","author":[{"given":"Ziqi","family":"Wang","sequence":"first","affiliation":[{"name":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou 510006, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-8468-1139","authenticated-orcid":false,"given":"Yufan","family":"Qiu","sequence":"additional","affiliation":[{"name":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou 510006, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-5890-5622","authenticated-orcid":false,"given":"Yaping","family":"Liu","sequence":"additional","affiliation":[{"name":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou 510006, China"},{"name":"Pengcheng Laboratory, Shenzhen 518000, China"}]},{"given":"Shuo","family":"Zhang","sequence":"additional","affiliation":[{"name":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou 510006, China"},{"name":"Pengcheng Laboratory, Shenzhen 518000, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-7242-7273","authenticated-orcid":false,"given":"Xinyi","family":"Liu","sequence":"additional","affiliation":[{"name":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou 510006, China"}]}],"member":"1968","published-online":{"date-parts":[[2025,8,21]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3457904","article-title":"A Survey on Encrypted Network Traffic Analysis Applications, Techniques, and Countermeasures","volume":"54","author":"Papadogiannaki","year":"2021","journal-title":"ACM Comput. Surv."},{"doi-asserted-by":"crossref","unstructured":"Chen, Y., You, W., Lee, Y., CHen, K., and Wang, X. (November, January 30). Mass Discovery of Android Traffic Imprints through Instantiated Partial Execution. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA.","key":"ref_2","DOI":"10.1145\/3133956.3134009"},{"doi-asserted-by":"crossref","unstructured":"Dai, S., Tongaonkar, A., Wang, X., Nucci, A., and Song, D. (2013, January 14\u201319). NetworkProfiler: Towards Automatic Fingerprinting of Android Apps. Proceedings of the 2013 Proceedings IEEE INFOCOM, Turin, Italy.","key":"ref_3","DOI":"10.1109\/INFCOM.2013.6566868"},{"doi-asserted-by":"crossref","unstructured":"Chen, Z., Yu, B., Zhang, Y., Zhang, J., and Xu, J. (2016, January 23\u201326). Automatic Mobile Application Traffic Identification by Convolutional Neural Networks. Proceedings of the 2016 IEEE Trustcom\/BigDataSE\/ISPA, Tianjin, China.","key":"ref_4","DOI":"10.1109\/TrustCom.2016.0077"},{"unstructured":"Choi, Y., Chung, J.Y., Park, B., and Hong, J. (2012, January 16\u201320). Automated Classifier Generation for Application-Level Mobile Traffic Identification. Proceedings of the 2012 IEEE Network Operations and Management Symposium, Maui, HI, USA.","key":"ref_5"},{"doi-asserted-by":"crossref","unstructured":"Liu, C., He, L., Xiong, G., Cao, Z., and Li, Z. (May, January 29). FS-Net: A Flow Sequence Network for Encrypted Traffic Classification. Proceedings of the IEEE INFOCOM 2019\u2014IEEE Conference on Computer Communications, Paris, France.","key":"ref_6","DOI":"10.1109\/INFOCOM.2019.8737507"},{"doi-asserted-by":"crossref","unstructured":"Sirinam, P., Imani, M., Juarez, M., and Wright, M. (2018, January 15\u201319). Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, Canada.","key":"ref_7","DOI":"10.1145\/3243734.3243768"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"107974","DOI":"10.1016\/j.comnet.2021.107974","article-title":"TSCRNN: A Novel Classification Scheme of Encrypted Traffic Based on Flow Spatiotemporal Features for Efficient Management of IIoT","volume":"190","author":"Lin","year":"2021","journal-title":"Comput. Netw."},{"doi-asserted-by":"crossref","unstructured":"Wang, W., Zhu, M., Wang, J., Zeng, X., and Yang, Z. (2017, January 22\u201324). End-to-End Encrypted Traffic Classification with One-Dimensional Convolution Neural Networks. Proceedings of the 2017 IEEE International Conference on Intelligence and Security Informatics (ISI), Beijing, China.","key":"ref_9","DOI":"10.1109\/ISI.2017.8004872"},{"unstructured":"Maniwa, R., Ichijo, N., Nakahara, Y., and Matsushima, T. (2024). Boosting-Based Sequential Meta-Tree Ensemble Construction for Improved Decision Trees. arXiv.","key":"ref_10"},{"unstructured":"Pu, F., Wang, Y., Ye, T., Jin, Y., Liu, Q., and Zou, Q. (March, January 27). Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis. Proceedings of the 2023 Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA.","key":"ref_11"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1999","DOI":"10.1007\/s00500-019-04030-2","article-title":"Deep Packet: A Novel Approach for Encrypted Traffic Classification Using Deep Learning","volume":"24","author":"Lotfollahi","year":"2020","journal-title":"Soft Comput."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"76","DOI":"10.1109\/MCOM.2019.1800819","article-title":"Deep Learning for Encrypted Traffic Classification: An Overview","volume":"57","author":"Rezaei","year":"2019","journal-title":"IEEE Commun. Mag."},{"unstructured":"Wang, Q., Qian, C., Li, X., Zhao, W., and Xu, K. (2024). Lens: A Foundation Model for Network Traffic in Cybersecurity. arXiv.","key":"ref_14"},{"unstructured":"Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., and Gelly, S. (2020). An Image Is Worth 16\u00d716 Words: Transformers for Image Recognition at Scale. arXiv.","key":"ref_15"},{"unstructured":"Devlin, J., Chang, M.W., Lee, K., and Toutanova, K. (2018). BERT: Pre-Training of Deep Bidirectional Transformers for Language Understanding. arXiv.","key":"ref_16"},{"unstructured":"Lan, Z., Chen, M., Goodman, S., Gimpel, K., Sharma, P., and Soricut, R. (2019). ALBERT: A Lite BERT for Self-Supervised Learning of Language Representations. arXiv.","key":"ref_17"},{"doi-asserted-by":"crossref","unstructured":"Liu, T., Ma, X., Liu, L., Xu, W., Zhu, Z., and Wang, Z. (2024). LAMBERT: Leveraging Attention Mechanisms to Improve the BERT Fine-Tuning Model for Encrypted Traffic Classification. Mathematics, 12.","key":"ref_18","DOI":"10.3390\/math12111624"},{"doi-asserted-by":"crossref","unstructured":"He, H.Y., Yang, Z.G., and Chen, X.N. (2020, January 7\u201311). PERT: Payload Encoding Representation from Transformer for Encrypted Traffic Classification. Proceedings of the 2020 ITU Kaleidoscope: Industry-Driven Digital Transformation (ITU K), Ha Noi, Vietnam.","key":"ref_19","DOI":"10.23919\/ITUK50268.2020.9303204"},{"doi-asserted-by":"crossref","unstructured":"Lin, X., Xiong, G., Gou, G., Li, Z., Shi, J., and Yu, J. (2022, January 25\u201329). ET-BERT: A Contextualized Datagram Representation with Pre-Training Transformers for Encrypted Traffic Classification. Proceedings of the WWW\u201922: The ACM Web Conference 2022, Lyon, France.","key":"ref_20","DOI":"10.1145\/3485447.3512217"},{"key":"ref_21","first-page":"5420","article-title":"Yet Another Traffic Classifier: A Masked Autoencoder Based Traffic Transformer with Multi-Level Flow Representation","volume":"37","author":"Zhao","year":"2023","journal-title":"Proc. AAAI Conf. Artif. Intell."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"208","DOI":"10.1007\/s11263-023-01852-4","article-title":"Context Autoencoder for Self-Supervised Representation Learning","volume":"132","author":"Chen","year":"2024","journal-title":"Int. J. Comput. Vis."},{"doi-asserted-by":"crossref","unstructured":"Zhao, Y., and Medvidovic, N. (2019, January 25). A Microservice Architecture for Online Mobile App Optimization. Proceedings of the 2019 IEEE\/ACM 6th International Conference on Mobile Software Engineering and Systems (MOBILESoft), Montreal, QC, Canada.","key":"ref_23","DOI":"10.1109\/MOBILESoft.2019.00017"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"445","DOI":"10.1109\/TNSM.2019.2899085","article-title":"Mobile Encrypted Traffic Classification Using Deep Learning: Experimental Evaluation, Lessons Learned, and Challenges","volume":"16","author":"Aceto","year":"2019","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_25","first-page":"1909020","article-title":"Flowprint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic","volume":"27","author":"Bortolameotti","year":"2020","journal-title":"Proc. NDSS Symp."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"20","DOI":"10.1109\/MNET.011.1900366","article-title":"Optimizing Feature Selection for Efficient Encrypted Traffic Classification: A Systematic Approach","volume":"34","author":"Shen","year":"2020","journal-title":"IEEE Netw."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"63","DOI":"10.1109\/TIFS.2017.2737970","article-title":"Robust Smartphone App Identification via Encrypted Network Traffic Analysis","volume":"13","author":"Taylor","year":"2017","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"unstructured":"Hayes, J., and Danezis, G. (2016, January 10\u201312). k-Fingerprinting: A Robust Scalable Website Fingerprinting Technique. Proceedings of the 25th USENIX Security Symposium, Austin, TX, USA.","key":"ref_28"},{"doi-asserted-by":"crossref","unstructured":"Taylor, V.F., Spolaor, R., Conti, M., and Berthome, P. (2016, January 21\u201324). Appscanner: Automatic Fingerprinting of Smartphone Apps from Encrypted Network Traffic. Proceedings of the IEEE European Symposium on Security and Privacy (EuroS&P), Saarbruecken, Germany.","key":"ref_29","DOI":"10.1109\/EuroSP.2016.40"},{"doi-asserted-by":"crossref","unstructured":"Al-Naami, K., Chandra, S., Mustafa, A., Khan, L., Lin, Z., Hamlen, K., and Thuraisingham, B. (2016, January 5\u20138). Adaptive Encrypted Traffic Fingerprinting with Bi-Directional Dependence. Proceedings of the 2016 Annual Computer Security Applications Conference, Los Angeles, CA, USA.","key":"ref_30","DOI":"10.1145\/2991079.2991123"},{"doi-asserted-by":"crossref","unstructured":"He, Y., and Li, W. (2020, January 27\u201330). Image-Based Encrypted Traffic Classification with Convolutional Neural Networks. Proceedings of the 2020 IEEE Fifth International Conference on Data Science in Cyberspace (DSC), Hong Kong, China.","key":"ref_31","DOI":"10.1109\/DSC50466.2020.00048"},{"doi-asserted-by":"crossref","unstructured":"Okonkwo, Z., Foo, E., Li, Q., and Hou, Z. (2022, January 14\u201318). A CNN Based Encrypted Network Traffic Classifier. Proceedings of the 2022 Australasian Computer Science Week, Brisbane, Australia.","key":"ref_32","DOI":"10.1145\/3511616.3513101"},{"doi-asserted-by":"crossref","unstructured":"Sengupta, S., Ganguly, N., De, P., and Chakraborty, S. (2019, January 13\u201317). Exploiting Diversity in Android TLS Implementations for Mobile App Traffic Classification. Proceedings of the WWW \u201919: The World Wide Web Conference, San Francisco, CA, USA.","key":"ref_33","DOI":"10.1145\/3308558.3313738"},{"doi-asserted-by":"crossref","unstructured":"Canard, S., Diop, A., Kheir, N., Paindavoine, M., and Sabt, M. (2017, January 2\u20136). BlindIDS: Market-Compliant and Privacy-Friendly Intrusion Detection System over Encrypted Traffic. Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, Abu Dhabi, United Arab Emirates.","key":"ref_34","DOI":"10.1145\/3052973.3053013"},{"unstructured":"Wei, H., Xie, R., Cheng, H., Feng, L., and Li, Y. (2022, January 17\u201323). Mitigating Neural Network Overconfidence with Logit Normalization. Proceedings of the 39th International Conference on Machine Learning, Baltimore, MD, USA.","key":"ref_35"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"1501","DOI":"10.1093\/comjnl\/bxad076","article-title":"A Large-Scale Mobile Traffic Dataset for Mobile Application Identification","volume":"67","author":"Zhao","year":"2024","journal-title":"Comput. J."},{"unstructured":"Wang, W., Zhu, M., Zeng, X., Ye, X., and Sheng, Y. (2017, January 11\u201313). Malware Traffic Classification Using Convolutional Neural Network for Representation Learning. Proceedings of the 2017 International Conference on Information Networking (ICOIN), Da Nang, Vietnam.","key":"ref_37"},{"unstructured":"Gil, G.D., Lashkari, A.H., Mamun, M., and Ghorbani, A. (2016, January 19\u201321). Characterization of Encrypted and VPN Traffic Using Time-Related Features. Proceedings of the 2nd International Conference on Information Systems Security and Privacy (ICISSP), Rome, Italy.","key":"ref_38"},{"unstructured":"Lashkari, A.H., Gil, G.D., Mamun, M., and Ghorbani, A. (2017, January 22\u201324). Characterization of Tor Traffic Using Time Based Features. Proceedings of the 3rd International Conference on Information Systems Security and Privacy, Lisbon, Portugal.","key":"ref_39"},{"doi-asserted-by":"crossref","unstructured":"Neto, E.C.P., Dadkhah, S., Ferreira, R., Zohourian, A., Lu, R., and Ghorbani, A. (2023). CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment. Sensors, 23.","key":"ref_40","DOI":"10.20944\/preprints202305.0443.v1"},{"doi-asserted-by":"crossref","unstructured":"Xie, G., Li, Q., Jiang, Y., Dai, T., Shen, G., Li, R., Sinnott, R., and Xia, S. (2020, January 10\u201314). SAM: Self-Attention Based Deep Learning Method for Online Traffic Classification. Proceedings of the Workshop on Network Meets AI & ML, Virtual.","key":"ref_41","DOI":"10.1145\/3405671.3405811"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"2367","DOI":"10.1109\/TIFS.2021.3050608","article-title":"Accurate Decentralized Application Identification via Encrypted Traffic Analysis Using Graph Neural Networks","volume":"16","author":"Shen","year":"2021","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"doi-asserted-by":"crossref","unstructured":"Zhang, H., Yu, L., Xiao, X., Li, Q., Mercaldo, F., Luo, X., and Liu, Q. (May, January 30). TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-Grained Encrypted Traffic Classification. Proceedings of the ACM Web Conference 2023, Austin, TX, USA.","key":"ref_43","DOI":"10.1145\/3543507.3583227"},{"key":"ref_44","first-page":"23477","article-title":"Website Fingerprinting at Internet Scale","volume":"1","author":"Panchenko","year":"2016","journal-title":"Proc. NDSS"},{"doi-asserted-by":"crossref","unstructured":"Wang, X., Chen, S., and Su, J. (2020, January 6\u20139). App-Net: A Hybrid Neural Network for Encrypted Mobile Traffic Classification. Proceedings of the IEEE INFOCOM 2020\u2014IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), Toronto, ON, Canada.","key":"ref_45","DOI":"10.1109\/INFOCOMWKSHPS50562.2020.9162891"},{"unstructured":"Schuster, R., Shmatikov, V., and Tromer, E. (2017, January 16\u201318). Beauty and the Burst: Remote Identification of Encrypted Video Streams. Proceedings of the 26th USENIX Security Symposium, Vancouver, BC, Canada.","key":"ref_46"},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"1504","DOI":"10.1109\/TNSM.2023.3262246","article-title":"Flow-Based Encrypted Network Traffic Classification with Graph Neural Networks","volume":"20","author":"Yang","year":"2023","journal-title":"IEEE Trans. Netw. Serv. Manag."}],"container-title":["Big Data and Cognitive Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2504-2289\/9\/8\/216\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:32:24Z","timestamp":1760034744000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2504-2289\/9\/8\/216"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,8,21]]},"references-count":47,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2025,8]]}},"alternative-id":["bdcc9080216"],"URL":"https:\/\/doi.org\/10.3390\/bdcc9080216","relation":{},"ISSN":["2504-2289"],"issn-type":[{"type":"electronic","value":"2504-2289"}],"subject":[],"published":{"date-parts":[[2025,8,21]]}}}