HF-Transformer: A Non-Pretrained Encrypted Network Traffic Classification Model Based on Packet Header Fields

Network traffic classification, aiming to classify network traffic into distinct management groups, plays an indispensable role in network monitoring, QoS, and intrusion detection. The widespread of encryption techniques applied to networks has made accurate traffic classification increasingly challenging. In recent years, raw traffic data as input to deep learning models has been widely adopted due to its high classification accuracy and low reliance on human-engineered features. Yet, a critical challenge remains: different bytes within a packet carry varying levels of discriminative information, and no consensus exists on the optimal representation unit for model input.In this paper, deep analysis of encrypted network traffic data is conducted, and our studies show that as the input to deep learning models, (1) byte-level representation outperforms bit-level encoding; (2) unigram byte features surpass the other ’n’-gram variants (halfgram, bigram, and trigram); (3) packet header bytes are significantly more discriminative than payload bytes, especially in highly encrypted datasets; and (4) certain header fields exhibit higher informativeness. Based on these findings, we propose HF-Transformer, a lightweight, non-pretrained model that leverages optimal header fields for classification. Evaluated across six datasets, HF-Transformer achieves up to 6.04% higher F1-score than SOTA alternatives, demonstrating its efficacy for encrypted traffic classification.