Bridging packet and session: Cross-level dual-attention networks for encrypted traffic classification

The widespread adoption of encryption technologies has greatly increased the complexity of network traffic classification, as plaintext features such as DNS are increasingly unavailable. Traditional payload-based approaches fail under strong encryption, while statistical and deep learning methods relying on single-level information often struggle to capture comprehensive traffic patterns. To address these challenges, we propose Cross-Level Encrypted Traffic (CLET), a novel classification model that integrates session-level and packet-level representations to capture comprehensive patterns in encrypted traffic. At the session level, CLET constructs an 87-dimensional attribute set encompassing certificate characteristics, temporal behaviors, and spatial distributions, providing a robust global view of each flow. At the packet level, CLET introduces a compact 13-dimensional attribute set processed by a hybrid CNN-Transformer network with dual attention mechanisms, learning fine-grained temporal and spatial dependencies while avoiding redundant information. By jointly leveraging global and local representations, CLET mitigates information loss and enhances feature discriminability. Experiments on the LFETT2021 and ISCX-VPN datasets show that CLET outperforms state-of-the-art baselines, demonstrating the effectiveness of cross-level learning for encrypted traffic classification.