Multi-Task Detection and Classification of Encrypted Traffic Sequences via Session2Token Embedding

The widespread adoption and advancement of encryption protocols have significantly reduced the visibility of network traffic. Consequently, a range of deep learning-based malicious traffic classification studies have actively employed input units such as packets, bursts, and sessions for detection and classification tasks. However, these conventional input formats suffer from performance degradation in encrypted environments, where data becomes randomized and attack traffic grows increasingly complex. In particular, analysis based solely on individual sessions faces fundamental limitations in capturing the sequential nature of attacks and the relational context between malicious sessions. To address these challenges, this study proposes a novel approach that constructs session sequences resembling real-world attack scenarios through a Traffic Sequence Generator and introduces a Session2Token Embedding method to represent each session as a fixed-length token. The proposed model leverages the generated session sequences as input to jointly perform multi-tasks: detecting the presence of malicious traffic within the sequence, classifying the type of attack, predicting the starting position of the first malicious session, and identifying the malicious or benign nature of each session within the sequence. Experimental results demonstrate that the model achieves high accuracy across all tasks, recording $99.8 \%$, $92.4 \%$, $97.1 \%$, and $99.9 \%$, respectively. This work represents the first attempt to learn and utilize the inter-session relationships in encrypted traffic, offering strong potential for practical deployment in real-world malicious traffic detection and classification systems.