FlowMiner: A Powerful Model Based on Flow Correlation Mining for Encrypted Traffic Classification

With the continuous development of traffic encryption techniques, the encrypted traffic classification task faces increasing challenges. Existing encrypted traffic classification methods primarily address the encryption problem by extracting side channel features, such as packet lengths and timing sequences. However, existing methods usually classify traffic at the flow or packet level. There are generally no mechanisms for mining correlations between different flow samples. Because of the loss of correlation information, the performance of these models in multiple tasks is greatly affected. To solve the above problems, we propose FlowMiner, a traffic graph classification model that mines correlations among different flow samples. It first extracts the temporal, length, content, byte distribution, and crossover features. FlowMiner uses these features as initial node features. Then, it constructs flow interaction graphs by analyzing the association between different flows. FlowMiner utilizes Graph Neural Networks to extract association features between different flows. It then generates a robust graph-level representation vector through an integrated pooling module, which is subsequently used for classification. Extensive experimental results on eight datasets show that FlowMiner significantly outperforms multiple state-of-the-art methods. Additionally, results from two real-world evaluation scenarios show that FlowMiner achieves over 95% precision in identifying malicious traffic, proving its effectiveness for practical applications.