EFGTC: An explainable federated graph learning framework for encrypted traffic classification

With the development of Decentralized Applications (DApps) and Virtual Private Networks (VPNs), encrypted traffic classification has become a core task of network security supervision. However, the implementation of data privacy regulations restricts the application of traditional centralized classification methods, making the problem of data silos increasingly prominent. Although Federated Learning (FL) provides a privacy-preserving paradigm for solving this problem, existing FL-based schemes mostly ignore the intrinsic topological structure of traffic data, leading to difficulties in extracting comprehensive features and a lack of interpretability in model decisions. To address these issues, this paper proposes EFGTC , an Explainable Federated Graph Learning Framework for Encrypted Traffic Classification. First, we propose a time-aware weighted graph construction method. Unlike traditional methods that purely use connection relationships, we construct a weighted topology graph rich in temporal rhythm by jointly encoding packet direction, length, and inter-arrival time, thereby enabling the graph data to more accurately express the interaction patterns of encrypted traffic. Second, we design a multi-scale feature extraction module based on an attention mechanism. This module not only captures comprehensive features from local handshake details to global flow patterns through multi-level aggregation but also achieves automatic screening and focusing of key data packets through an attention pooling mechanism, effectively suppressing data noise. Finally, experiments on three public datasets within the FL framework show that EFGTC consistently outperforms baselines across all metrics and exhibits strong robustness. Attention-weight visualizations further confirm that the model identifies key traffic-category fingerprints, enhancing interpretability.