Encrypted Traffic Detection in Resource Constrained IoT Networks: A Diffusion Model and LLM Integrated Framework

2025-12-24

AI Summary

To address the challenges of dynamic pattern recognition, scarce labeled data, and stringent latency/computational constraints in encrypted traffic detection for resource-constrained IoT networks, this paper proposes a lightweight detection framework synergizing diffusion models and large language models (LLMs). We design a multi-level feature fusion self-supervised diffusion encoding mechanism and introduce an LLM-guided dual-objective particle swarm optimization (PSO) for dynamic feature selection. Coupled with contrastive learning and multi-scale traffic visualization preprocessing, the framework significantly enhances generalizability and efficiency. Evaluated on USTC-TFC, ISCX-VPN, and Edge-IIoTset datasets, it achieves accuracies of 98.87%, 92.61%, and 99.83%, respectively—yielding a 3.7% average improvement in precision and a 41.9% reduction in training time. This work establishes a novel, efficient paradigm for real-time encrypted traffic analysis at the network edge.

Technology Category

• Machine Learning: Learning on the Edge & Model Compression
• Computer Vision: Diffusion Models for Vision
• Natural Language Processing: Safety and Robustness

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

The proliferation of Internet-of-things (IoT) infrastructures and the widespread adoption of traffic encryption present significant challenges, particularly in environments characterized by dynamic traffic patterns, constrained computational capabilities, and strict latency constraints. In this paper, we propose DMLITE, a diffusion model and large language model (LLM) integrated traffic embedding framework for network traffic detection within resource-limited IoT environments. The DMLITE overcomes these challenges through a tri-phase architecture including traffic visual preprocessing, diffusion-based multi-level feature extraction, and LLM-guided feature optimization. Specifically, the framework utilizes self-supervised diffusion models to capture both fine-grained and abstract patterns in encrypted traffic through multi-level feature fusion and contrastive learning with representative sample selection, thus enabling rapid adaptation to new traffic patterns with minimal labeled data. Furthermore, DMLITE incorporates LLMs to dynamically adjust particle swarm optimization parameters for intelligent feature selection by implementing a dual objective function that minimizes both classification error and variance across data distributions. Comprehensive experimental validation on benchmark datasets confirms the effectiveness of DMLITE, achieving classification accuracies of 98.87%, 92.61%, and 99.83% on USTC-TFC, ISCX-VPN, and Edge-IIoTset datasets, respectively. This improves classification accuracy by an average of 3.7% and reduces training time by an average of 41.9% compared to the representative deep learning model.

Problem

• Detects encrypted traffic in resource-limited IoT networks
• Adapts to dynamic traffic patterns with minimal labeled data
• Optimizes feature selection using diffusion and large language models

Innovation

• Diffusion model extracts multi-level features from encrypted traffic
• LLM optimizes feature selection via dynamic particle swarm parameters
• Self-supervised learning adapts quickly with minimal labeled data