Traffic-CBM: A Structurally Interpretable Multimodal Framework for Encrypted Traffic Classification

2026-06-29

AI Summary

This work addresses the limited interpretability of existing encrypted traffic classification models, which struggle to quantify the contributions of heterogeneous features to predictions. To overcome this, the authors propose a structured multimodal interpretable framework that maps flow statistics, temporal dynamics, and byte-level information into a unified hierarchical concept space—without requiring manually annotated semantic attributes. Explicit multilevel concept representations are constructed through grouped statistical mapping, a dedicated temporal encoder, and a byte-to-packet-level concept organization scheme, enabling a principled fusion mechanism. Evaluated on multiple encrypted traffic benchmarks, the method achieves competitive classification performance while offering a clearer and more structured interpretability interface compared to end-to-end black-box models.

Abstract

Encrypted traffic classification has achieved strong performance, but its decision process remains difficult to interpret. Existing methods usually combine flow statistics, packet sequences, and byte-level representations into opaque latent features, making it unclear which type of evidence actually drives the prediction. In this paper, we propose Traffic-CBM, a structurally interpretable multimodal framework for encrypted traffic classification. Instead of directly fusing heterogeneous traffic signals into a black-box representation, Traffic-CBM organizes them into a unified hierarchical concept space. These concepts are not manually annotated semantic attributes; rather, they are scalar evidence summaries constrained by predefined traffic evidence groups. More specifically, grouped flow statistics are mapped to statistical concepts, dedicated temporal encoders learn temporal concepts from disjoint feature subspaces, and byte-level evidence is further organized into packet-level and cross-packet concepts. This design turns heterogeneous traffic evidence into an explicit concept representation and makes different levels of traffic evidence easier to analyze. We evaluate Traffic-CBM on multiple encrypted traffic benchmarks. Results show that it achieves competitive and balanced classification performance while providing a clearer structural interpretation interface than conventional end-to-end fusion models. Further analyses suggest that the learned concept space is actively used in the prediction process and provides a clearer structural explanation of multimodal traffic evidence.

Problem

• encrypted traffic classification
• interpretability
• multimodal fusion
• black-box models
• traffic evidence

Innovation

• structurally interpretable
• multimodal framework
• encrypted traffic classification
• concept bottleneck model
• hierarchical concept space