{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,24]],"date-time":"2026-06-24T16:44:00Z","timestamp":1782319440098,"version":"3.54.5"},"reference-count":55,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2025,3,3]],"date-time":"2025-03-03T00:00:00Z","timestamp":1740960000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Key Research Project of Zhejiang Province, China","award":["6692023C0102"],"award-info":[{"award-number":["6692023C0102"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Network traffic classification is crucial for effective security management. However, the increasing prevalence of encrypted traffic and the confidentiality of protocol details have made this task more challenging. To address this issue, we propose a progressive, adaptive traffic classification method called SwiftSession, designed to achieve real-time and accurate classification. SwiftSession extracts statistical and sequential features from the first K packets of traffic. Statistical features capture overall characteristics, while sequential features reflect communication patterns. An initial classification is conducted based on the first K packets during the classification process. If the prediction meets the predefined probability threshold, processing stops; otherwise, additional packets are received. This progressive approach dynamically adjusts the required packets, enhancing classification efficiency. Experimental results show that traffic can be effectively classified by using only the initial K packets. Moreover, on most datasets, the classification time is reduced by more than 70%. Unlike existing methods, SwiftSession enhances the classification speed while ensuring classification accuracy.<\/jats:p>","DOI":"10.3390\/fi17030114","type":"journal-article","created":{"date-parts":[[2025,3,3]],"date-time":"2025-03-03T10:15:03Z","timestamp":1740996903000},"page":"114","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["SwiftSession: A Novel Incremental and Adaptive Approach to Rapid Traffic Classification by Leveraging Local Features"],"prefix":"10.3390","volume":"17","author":[{"given":"Tieqi","family":"Xi","sequence":"first","affiliation":[{"name":"School of Cyberspace Security, Hangzhou Dianzi University, Hangzhou 310018, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qiuhua","family":"Zheng","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Hangzhou Dianzi University, Hangzhou 310018, China"},{"name":"Key Laboratory of Discrete Industrial Internet of Things of Zhejiang Province, Hangzhou 310000, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chuanhui","family":"Cheng","sequence":"additional","affiliation":[{"name":"The School of Information and Safety Engineering, Zhongnan University of Economics and Law, Wuhan 430060, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ting","family":"Wu","sequence":"additional","affiliation":[{"name":"Hangzhou Innovation Institute, Beihang University, Hangzhou 310020, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Guojie","family":"Xie","sequence":"additional","affiliation":[{"name":"Zhejiang Key Laboratory of Open Data, Hangzhou 310000, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xuebiao","family":"Qian","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Hangzhou Dianzi University, Hangzhou 310018, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Haochen","family":"Ye","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Hangzhou Dianzi University, Hangzhou 310018, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhenyu","family":"Sun","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Hangzhou Dianzi University, Hangzhou 310018, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,3,3]]},"reference":[{"key":"ref_1","unstructured":"Dovrolis, C. (April, January 31). Toward the Accurate Identification of Network Applications. Proceedings of the Passive and Active Network Measurement, Boston, MA, USA."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"3951","DOI":"10.1109\/TMM.2023.3318242","article-title":"Skeleton-Based Gesture Recognition with Learnable Paths and Signature Features","volume":"26","author":"Cheng","year":"2024","journal-title":"IEEE Trans. Multimed."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"63","DOI":"10.1109\/TIFS.2017.2737970","article-title":"Robust Smartphone App Identification via Encrypted Network Traffic Analysis","volume":"13","author":"Taylor","year":"2018","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_4","first-page":"1693","article-title":"Path signatures for diversity in probabilistic trajectory optimisation","volume":"43","author":"Barcelos","year":"2024","journal-title":"Int. J. Robot. Res."},{"key":"ref_5","first-page":"395","article-title":"Integration of Paths\u2014A Faithful Representation of Paths by Noncommutative Formal Power Series","volume":"89","author":"Chen","year":"1958","journal-title":"Trans. Am. Math. Soc."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"3674","DOI":"10.1007\/s12083-021-01214-2","article-title":"SFIM: Identify User Behavior Based on Stable Features","volume":"14","author":"Wu","year":"2021","journal-title":"Peer-to-Peer Netw. Appl."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"2166","DOI":"10.1109\/TIFS.2022.3179955","article-title":"Seeing Traffic Paths: Encrypted Traffic Classification with Path Signature Features","volume":"17","author":"Xu","year":"2022","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"567","DOI":"10.1016\/j.jnca.2012.12.020","article-title":"A Survey of Network Flow Applications","volume":"36","author":"Li","year":"2013","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Karagiannis, T., Broido, A., Faloutsos, M., and Claffy, K. (2004, January 25\u201327). Transport Layer Identification of P2P Traffic. Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement, Taormina Sicily, Italy.","DOI":"10.1145\/1028788.1028804"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"32","DOI":"10.1016\/j.jnca.2019.02.022","article-title":"Implementation of Deep Packet Inspection in Smart Grids and Industrial Internet of Things: Challenges and Opportunities","volume":"135","author":"Rad","year":"2019","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Cheng, J., He, R., Yuepeng, E., Wu, Y., You, J., and Li, T. (2020, January 7\u201311). Real-Time Encrypted Traffic Classification via Lightweight Neural Networks. Proceedings of the GLOBECOM 2020\u20142020 IEEE Global Communications Conference, Taipei, Taiwan.","DOI":"10.1109\/GLOBECOM42002.2020.9322309"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Velan, P., Medkov\u00e1, J., Jirs\u00edk, T., and \u010celeda, P. (2016, January 25\u201329). Network Traffic Characterisation Using Flow-Based Statistics. Proceedings of the NOMS 2016\u20142016 IEEE\/IFIP Network Operations and Management Symposium, Istanbul, Turkey.","DOI":"10.1109\/NOMS.2016.7502924"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"676","DOI":"10.1016\/j.dcan.2022.09.009","article-title":"Network Traffic Classification: Techniques, Datasets, and Challenges","volume":"10","author":"Azab","year":"2024","journal-title":"Digit. Commun. Netw."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Taylor, V.F., Spolaor, R., Conti, M., and Martinovic, I. (2016, January 21\u201324). AppScanner: Automatic Fingerprinting of Smartphone Apps from Encrypted Network Traffic. Proceedings of the 2016 IEEE European Symposium on Security and Privacy (EuroS&P), Saarbrucken, Germany.","DOI":"10.1109\/EuroSP.2016.40"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"3242","DOI":"10.1109\/JIOT.2020.3002255","article-title":"CorrAUC: A Malicious Bot-IoT Traffic Detection Method in IoT Network Using Machine-Learning Techniques","volume":"8","author":"Shafiq","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"158561","DOI":"10.1109\/ACCESS.2024.3485588","article-title":"Elephant Flow Detection with Random Forest Models under Programmable Network Dataplane Constraints","volume":"12","author":"Jurkiewicz","year":"2024","journal-title":"IEEE Access"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"105744","DOI":"10.1109\/ACCESS.2024.3436056","article-title":"Machine Learning-Based Elephant Flow Classification on the First Packet","volume":"12","author":"Jurkiewicz","year":"2024","journal-title":"IEEE Access"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Panchenko, A., Lanze, F., Pennekamp, J., Engel, T., Zinnen, A., Henze, M., and Wehrle, K. (2016, January 21\u201324). Website Fingerprinting at Internet Scale. Proceedings of the NDSS\u201916, San Diego, CA, USA.","DOI":"10.14722\/ndss.2016.23477"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Pan, W., Cheng, G., and Tang, Y. (2017, January 1\u20134). WENC: HTTPS Encrypted Traffic Classification Using Weighted Ensemble Learning and Markov Chain. Proceedings of the 2017 IEEE Trustcom\/BigDataSE\/ICESS, Sydney, Australia.","DOI":"10.1109\/Trustcom\/BigDataSE\/ICESS.2017.219"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Liu, C., Cao, Z., Xiong, G., Gou, G., Yiu, S.-M., and He, L. (2018, January 4\u20136). MaMPF: Encrypted Traffic Classification Based on Multi-Attribute Markov Probability Fingerprints. Proceedings of the 2018 IEEE\/ACM 26th International Symposium on Quality of Service (IWQoS), Banff, AB, Canada.","DOI":"10.1109\/IWQoS.2018.8624124"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Liu, C., He, L., Xiong, G., Cao, Z., and Li, Z. (May, January 29). FS-Net: A Flow Sequence Network For Encrypted Traffic Classification. Proceedings of the IEEE INFOCOM 2019\u2014IEEE Conference on Computer Communications, Paris, France.","DOI":"10.1109\/INFOCOM.2019.8737507"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"110147","DOI":"10.1016\/j.comnet.2023.110147","article-title":"NetTiSA: Extended IP Flow with Time-Series Features for Universal Bandwidth-Constrained High-Speed Network Traffic Classification","volume":"240","author":"Koumar","year":"2024","journal-title":"Comput. Netw."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"445","DOI":"10.1109\/TNSM.2019.2899085","article-title":"Mobile Encrypted Traffic Classification Using Deep Learning: Experimental Evaluation, Lessons Learned, and Challenges","volume":"16","author":"Aceto","year":"2019","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Lin, X., Xiong, G., Gou, G., Li, Z., Shi, J., and Yu, J. (2022, January 25\u201329). ET-BERT: A Contextualized Datagram Representation with Pre-Training Transformers for Encrypted Traffic Classification. Proceedings of the ACM Web Conference 2022, Lyon, France.","DOI":"10.1145\/3485447.3512217"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"102985","DOI":"10.1016\/j.jnca.2021.102985","article-title":"DISTILLER: Encrypted Traffic Classification via Multimodal Multitask Deep Learning","volume":"183\u2013184","author":"Aceto","year":"2021","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Zhang, H., Yu, L., Xiao, X., Li, Q., Mercaldo, F., Luo, X., and Liu, Q. (May, January 30). TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-Grained Encrypted Traffic Classification. Proceedings of the ACM Web Conference 2023, Austin, TX, USA.","DOI":"10.1145\/3543507.3583227"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"1224","DOI":"10.1109\/TNSM.2022.3227500","article-title":"Flow-Based Encrypted Network Traffic Classification with Graph Neural Networks","volume":"20","author":"Huoh","year":"2023","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3625306","article-title":"Efficient IoT Traffic Inference: From Multi-View Classification to Progressive Monitoring","volume":"5","author":"Pashamokhtari","year":"2023","journal-title":"ACM Trans. Internet Things"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Pinto, D., Vitorino, J., Maia, E., Amorim, I., and Pra\u00e7a, I. (2024). Flow Exporter Impact on Intelligent Intrusion Detection Systems 2024. arXiv.","DOI":"10.5220\/0013131900003899"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"1946","DOI":"10.1109\/TNSM.2020.3028197","article-title":"Mobile Traffic Classification through Physical Control Channel Fingerprinting: A Deep Learning Approach","volume":"18","author":"Trinh","year":"2021","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Chen, Y., Tong, Y., Hwee, G.B., Cao, Q., Razul, S.G., and Lin, Z. (2023, January 21\u201325). Real-Time Traffic Classification in Encrypted Wireless Communication Network. Proceedings of the 2023 IEEE International Symposium on Circuits and Systems (ISCAS), Monterey, CA, USA.","DOI":"10.1109\/ISCAS46773.2023.10181886"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1145\/1071690.1064220","article-title":"Internet Traffic Classification Using Bayesian Analysis Techniques","volume":"33","author":"Moore","year":"2005","journal-title":"SIGMETRICS Perform. Eval. Rev."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Efanov, A.A., Ivliev, S.A., and Shagraev, A.G. (2021, January 11\u201313). Welford\u2019s Algorithm for Weighted Statistics. Proceedings of the 2021 3rd International Youth Conference on Radio Electronics, Electrical and Power Engineering (REEPE), Moscow, Russia.","DOI":"10.1109\/REEPE51337.2021.9387973"},{"key":"ref_34","unstructured":"Chevyrev, I., and Kormilitzin, A. (2016). A Primer on the Signature Method in Machine Learning 2016. arXiv."},{"key":"ref_35","unstructured":"Zhou, S. (2019). Signatures, Rough Paths and Applications in Machine Learning. [Bachelor\u2019s Thesis, Utrecht University]."},{"key":"ref_36","unstructured":"Gyurk\u00f3, L.G., Lyons, T., Kontkowski, M., and Field, J. (2014). Extracting Information from the Signature of a Financial Data Stream. arXiv."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Xu, X., Lee, D., Drougard, N., and Roy, R.N. (2023). Signature Methods for Brain-Computer Interfaces. Sci. Rep., 13.","DOI":"10.1038\/s41598-023-41326-8"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"72","DOI":"10.1093\/cercor\/bhae069","article-title":"Early Autism Diagnosis Based on Path Signature and Siamese Unsupervised Feature Compressor","volume":"34","author":"Yin","year":"2024","journal-title":"Cereb. Cortex"},{"key":"ref_39","first-page":"2825","article-title":"Scikit-Learn: Machine Learning in Python","volume":"12","author":"Pedregosa","year":"2011","journal-title":"J. Mach. Learn. Res."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Zhai, L., Zheng, Q., Zhang, X., Hu, H., Yin, W., Zeng, Y., and Wu, T. (2021). Identification of Private ICS Protocols Based on Raw Traffic. Symmetry, 13.","DOI":"10.3390\/sym13091743"},{"key":"ref_41","unstructured":"(2023, June 26). SCADA\/ICS PCAP Files from 4SICS. Available online: https:\/\/www.netresec.com\/?page=PCAP4SICS."},{"key":"ref_42","unstructured":"(2024, October 20). DynamiteLab\u2014A Free Online PCAP File Viewer and Analyzer. Available online: https:\/\/lab.dynamite.ai\/."},{"key":"ref_43","unstructured":"(2024, October 20). A Realistic Cyber Defense Dataset (CSE-CIC-IDS2018)\u2014Registry of Open Data on AWS. Available online: https:\/\/registry.opendata.aws\/cse-cic-ids2018\/."},{"key":"ref_44","unstructured":"Balamurugan, S.P., Granda, S., Haile, S., and Petersen, A. (2024, July 03). A Dataset of Cyber-Induced Mechanical Faults on Buildings with Network and Buildings Data 2023. 12 Files, Available online: https:\/\/data.nrel.gov\/submissions\/210."},{"key":"ref_45","unstructured":"Radoglou-Grammatikis, P., Kelli, V., Lagkas, T., Argyriou, V., and Panagiotis, S. (2024, August 03). DNP3 Intrusion Detection Dataset 2022. Available online: https:\/\/ieee-dataport.org\/documents\/dnp3-intrusion-detection-dataset."},{"key":"ref_46","unstructured":"(2024, October 20). Electra Dataset: Anomaly Detection ICS Dataset. Available online: http:\/\/perception.inf.um.es\/ICS-datasets\/."},{"key":"ref_47","unstructured":"Radoglou-Grammatikis, P., Rompolos, K., Lagkas, T., Argyriou, V., and Sarigiannidis, P. (2022). IEC 60870-5-104 Intrusion Detection Dataset. IEEE Dataport, 104."},{"key":"ref_48","unstructured":"(2024, October 20). CSET \u201916. Available online: https:\/\/www.usenix.org\/conference\/cset16."},{"key":"ref_49","unstructured":"Hindy, H. (2024, October 20). MQTT-IoT-IDS2020: MQTT Internet of Things Intrusion Detection Dataset 2020. Available online: https:\/\/ieee-dataport.org\/open-access\/mqtt-iot-ids2020-mqtt-internet-things-intrusion-detection-dataset."},{"key":"ref_50","doi-asserted-by":"crossref","unstructured":"Draper-Gil, G., Lashkari, A.H., Mamun, M.S.I., and Ghorbani, A.A. (2016, January 19\u201321). Characterization of Encrypted and VPN Traffic Using Time-Related Features. Proceedings of the 2nd International Conference on Information Systems Security and Privacy, Rome, Italy.","DOI":"10.5220\/0005740704070414"},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Habibi Lashkari, A., Draper Gil, G., Mamun, M., and Ghorbani, A. (2017, January 19\u201321). Characterization of Tor Traffic Using Time Based Features. Proceedings of the 3rd International Conference on Information Systems Security and Privacy (ICISSP 2017), Porto, Portugal.","DOI":"10.5220\/0006105602530262"},{"key":"ref_52","unstructured":"(2025, January 13). SplitCap\u2014A Fast PCAP File Splitter. Available online: https:\/\/www.netresec.com\/?page=SplitCap."},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"4364","DOI":"10.1109\/ACCESS.2016.2597538","article-title":"Fine-Grained HTTP Web Traffic Analysis Based on Large-Scale Mobile Datasets","volume":"4","author":"Fang","year":"2016","journal-title":"IEEE Access"},{"key":"ref_54","doi-asserted-by":"crossref","unstructured":"Bazaluk, B., Hamdan, M., Ghaleb, M., Gismalla, M.S.M., Correa da Silva, F.S., and Batista, D.M. (2024, January 6\u201310). Towards a Transformer-Based Pre-Trained Model for IoT Traffic Classification. Proceedings of the NOMS 2024-2024 IEEE Network Operations and Management Symposium, Seoul, Republic of Korea.","DOI":"10.1109\/NOMS59830.2024.10575448"},{"key":"ref_55","doi-asserted-by":"crossref","unstructured":"Liu, Y., Chen, J., Chang, P., and Yun, X. (2017, January 8\u201311). A Novel Algorithm for Encrypted Traffic Classification Based on Sliding Window of Flow\u2019s First N Packets. Proceedings of the 2017 2nd IEEE International Conference on Computational Intelligence and Applications (ICCIA), Beijing, China.","DOI":"10.1109\/CIAPP.2017.8167261"}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/17\/3\/114\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T16:46:26Z","timestamp":1760028386000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/17\/3\/114"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,3,3]]},"references-count":55,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2025,3]]}},"alternative-id":["fi17030114"],"URL":"https:\/\/doi.org\/10.3390\/fi17030114","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,3,3]]}}}