Knowledge-Enhanced Zero-Shot Graph Learning-Based Mobile Application Identification

With the proliferation of mobile devices, identifying previously unseen mobile applications has become a critical challenge in network security. Traditional application identification approaches rely heavily on fixed training categories and limited traffic features, making them ineffective in real-world environments. To address this problem, we propose KZGNN, a knowledge-enhanced zero-shot graph neural network for mobile application identification. KZGNN first constructs a unified mobile application knowledge graph that integrates high-level semantic metadata with fine-grained network behavior, enabling structured representation of application characteristics. Building on this, KZGNN introduces a relation-aware dual-channel propagation mechanism that separates semantic relations and behavioral interactions into dedicated GNN pathways and adaptively fuses them through attention. To support zero-shot recognition, KZGNN projects node embeddings and category semantics into a shared embedding space, where a structure-preserving constraint maintains global semantic geometry and improves generalization to unseen categories. Experiments on a dataset of 160 mobile applications show that KZGNN outperforms nine state-of-the-art traffic classification baselines and achieves a 5.2% improvement in identifying unseen application categories, demonstrating its effectiveness for mobile application identification in zero-shot scenarios.