Noise Resistant Encrypted Malicious Traffic Detection Through Kernel-Enhanced Contrastive View Alignment

Encrypted Malicious Traffic Detection (EMTD) is challenging due to the limitations of inspecting encrypted content and the scarcity of labeled data. Graph Contrastive Learning (GCL) offers a promising direction by representing traffic as graphs, yet existing approaches struggle to capture global relationships and remain vulnerable to noise. To address these, we propose KerCL, a Kernel-Enhanced Contrastive Learning framework for robust EMTD. KerCL introduces kernel-based graph convolution to capture both local and global traffic dependencies, enhancing the ability to understand the long-range context of encrypted traffic. Furthermore, we propose a dependency-guided graph reconstruction strategy, which restructures adjacency matrices based on learned kernel similarities, ensuring structural integrity while improving diversity in augmented views. To reduce noise-induced semantic drift, we introduce a novel contrastive dependency alignment mechanism. It leverages the Hilbert-Schmidt independence criterion to enforce semantic consistency across augmented views while preserving stability of traffic representations. Experiments on several benchmarks show that KerCL surpasses previous methods in consistency, robustness, and noise tolerance. On the DoHBrw dataset with 50% noise and only 2,000 labels, KerCL improves the F1-score by over 28% compared with the best baseline, showcasing its effectiveness under noisy, label-sparse network conditions.