Research on Encrypted Traffic Behavior Recognition Method by Fusing Vision Transformer and Dynamic Graph Convolution

ABSTRACT With the widespread application of encrypted traffic, traditional network traffic analysis methods based on plaintext packets face significant challenges. To identify potential threats in encrypted traffic, this paper introduces a novel method combining Vision Transformer and Dynamic Graph Convolutional Networks. These two models specialize in global and local feature modeling, respectively. This integration combines the complementary strengths of Vision Transformer in capturing global dependencies and Dynamic Graph Convolutional Network in modeling local dynamic interactions, resulting in a robust solution for encrypted traffic behavior recognition. This fusion allows the model to effectively capture both long‐range dependencies and fine‐grained local interactions, making it well suited to the complex and evolving nature of encrypted traffic. The fusion of these two models is original and greatly improves the accuracy and robustness of behavior recognition. By combining ViT's global feature extraction with DGCN's local relationship modeling, this method effectively addresses the complexity and dynamic nature of encrypted traffic. As demonstrated in the experimental results, the fusion model combining ViT and DGCN significantly outperforms the standalone ViT and DGCN models across all key performance metrics. Specifically, the fusion model achieved an accuracy of 95.1%, a recall rate of 95.5%, and an F1‐score of 94.9%, surpassing the accuracy rates of ViT and DGCN when used individually. These improvements highlight the complementary capabilities of ViT in capturing global features and DGCN in modeling local relationships, which together enable more precise and robust encrypted traffic behavior recognition. These results show that the combination of ViT and DGCN can more accurately capture spatiotemporal features in encrypted traffic, thereby significantly improving behavior recognition accuracy. During the training process, the model combining ViT and DGCN showed better convergence speed and stability. Notably, the fusion model exhibited a rapid decrease in the loss function during the initial epochs, reaching a final loss value of 0.096 after 50 rounds of training. This was significantly lower than the loss values observed in ViT and DGCN models trained separately. The model's performance peak was observed around the 20th epoch, after which the accuracy stabilized, further indicating the method's strong optimization ability in handling complex encrypted traffic. In addition, the accuracy rate of the model rapidly rose and stabilized after 20 epochs of training, ultimately reaching 95.1%, indicating that the method demonstrates stronger stability and optimization ability when handling complex encrypted traffic. The encrypted traffic behavior identification method, which integrates ViT and DGCN, demonstrates significant advantages in terms of accuracy, training stability, and adaptability. It offers efficient and reliable solutions for encrypted traffic analysis and network security monitoring.