1.西安交通大学电子与信息学部,陕西西安 710049
2.智能网络与网络安全教育部重点实验室,陕西西安 710049
3.陕西省计算机网络重点实验室,陕西西安 710049
卞华峰 男,1997年8月出生于江苏省淮安市。现为西安交通大学计算机科学与技术学院博士研究生。主要研究方向为流量分析、无线安全。 E-mail: t1071680825@stu.xjtu.edu.cn
郑纪成 男,2001年8月出生于河北省承德市。现为西安交通大学计算机科学与技术学院博士研究生。主要研究方向为流量分析。 E-mail: 3123151037@stu.xjtu.edu.cn
马小博 男,1983年9月出生于陕西省宝鸡市。现为西安交通大学电信学部教授、博士生导师。主要研究方向为网络安全与隐私、网络测量。中国电子学会会员编号:E190036656M。 E-mail: xma.cs@xjtu.edu.cn
刘宏桃 男,1997年6月出生于山西省吕梁市。2024年毕业于西安交通大学软件学院,获工学硕士学位。主要研究方向为网络安全。 E-mail: lht974868031@stu.xjtu.edu.cn
管晓宏 男,1955年11月出生于四川省泸州市。现为西安交通大学电信学部教授、博士生导师,中国科学院院士。主要研究方向为复杂网络化系统的经济性与安全性,电力、能源、制造系统的优化,网络空间安全,信息物理融合系统等。中国电子学会会员编号:E190184944M。E-mail: xhguan@xjtu.edu.cn
收稿:2026-01-08,
录用:2026-02-09,
网络首发:2026-05-20,
纸质出版:2026-04-25
移动端阅览
卞华峰, 郑纪成, 马小博, 等. 探索密流分析鲜度模型:从“数据留存”到“价值沉淀”[J]. 电子学报, 2026, 54(04): 1446-1459.
BIAN Huafeng, ZHENG Jicheng, MA Xiaobo, et al. Exploring Freshness Modeling for Encrypted Traffic Analysis: From “Data Retention” to “Value Accumulation”[J]. Acta Electronica Sinica, 2026, 54(04): 1446-1459.
卞华峰, 郑纪成, 马小博, 等. 探索密流分析鲜度模型:从“数据留存”到“价值沉淀”[J]. 电子学报, 2026, 54(04): 1446-1459. DOI:10.12263/DZXB.20251008
BIAN Huafeng, ZHENG Jicheng, MA Xiaobo, et al. Exploring Freshness Modeling for Encrypted Traffic Analysis: From “Data Retention” to “Value Accumulation”[J]. Acta Electronica Sinica, 2026, 54(04): 1446-1459. DOI:10.12263/DZXB.20251008
众所周知,网络流量呈海量化与密态化发展趋势。受限于计算与存储资源,流量分析系统难以对高速海量密流进行在线建模并全量存储,通常采用“先存后筛”的序贯策略,即先完整留存目标密流后,再筛选代表性样本开展分析。此策略依赖人工定义特定留存目标(如特定IP地址范围),难以应对流量的动态演化特性,导致留存数据的边际价值不断递减。即使人为提升留存目标多样性,由于缺乏系统化价值评价体系,不同留存数据仍难以实现价值沉淀,无法反向优化数据留存策略。为此,本文提出一种密流分析鲜度方法(FreshHunter)。该方法从时间、空间与语义三个维度系统化建模密流鲜度,时间维度采用牛顿水冷定律刻画密流的自然老化特征,空间和语义维度提取跨类型、跨行为的通用个体结构特征。进一步地,FreshHunter构建了鲜度感知的对比学习框架,通过引入可学习类中心,增强密流特征嵌入与类中心间的一致性,确保密流样本群体多样性,并实现“边筛边存”的高鲜度密流样本在线留存机制。在留存过程中,FreshHunter将高鲜度密流的特征嵌入不断聚合至可学习类中心,以构建代表性密流特征的统一表示;同时结合特征漂移检测与自适应校正机制,动态更新类中心,以捕捉密流特征的时序性演化。由此,FreshHunter同时捕捉高价值、代表性的密流样本及其演化,促成了从瞬时数据捕获到长期知识累积的升级,为下游密流分析提供前向知识沉淀、后向持续优化的数据支撑。本文在真实数据集上开展广泛评估,覆盖物联网(Internet of Things,IoT)终端、手机App和网站识别三类典型密流分析任务及九种主流分析算法。实验结果表明,FreshHunter可提升下游密流分析算法的
F
1
分数约15%~60%,优于Random、动态时间规整(Dynamic Time Warping,DTW)、树模型沙普利加性解释(Tree SHAPley additive explanations,TreeSHAP)三种基线密流筛选方法。在特征漂移场景下,FreshHunter仍保持较强适应性,提升
F
1
分数约20%。本研究为资源受限条件下密流分析的数据利用率和模型性能增强提供了新的技术路径。
As is well known
network traffic has become increasingly massive and encrypted. Due to limitations in computational and storage resources
traffic analysis systems struggle to perform online modeling and full-volume storage of high-speed encrypted traffic. Existing systems typically adopt a “store-then-select” strategy
wherein all target encrypted traffic is fully retained before being selected for analysis. However
this strategy relies on manually defined retention targets (e.g.
specific IP ranges)
making it difficult to adapt to dynamic traffic evolution and resulting in a diminishing marginal value of retained data. Despite deliberate efforts to increase the diversity of retention targets
the absence of a systematic value evaluation framework hinders the accumulation of
data value and precludes the feedback-driven optimization of retention strategies. To address these challenges
this paper proposes FreshHunter
a freshness modeling approach for encrypted traffic analysis. FreshHunter systematically models the freshness of encrypted traffic from three dimensions: temporal
spatial
and semantic. The temporal dimension adopts Newton’s law of cooling to describe the natural aging of encrypted traffic
whereas the spatial and semantic dimensions extract structural features that are universal across types and behaviors. In addition
FreshHunter constructs a freshness-aware contrastive learning framework that incorporates learnable class centers to enhance the consistency between traffic embeddings and their corresponding centers
preserve the diversity of traffic samples
and thereby enable a “select-while-storing” mechanism for retaining high-freshness samples. During retention
FreshHunter continuously aggregates the embeddings of high-freshness encrypted traffic into learnable class centers
thereby forming a unified representation of representative traffic features. Meanwhile
it employs feature drift detection and adaptive correction mechanisms to dynamically update these class centers and capture the temporal evolution of traffic features. Thus
FreshHunter captures high-value
representative encrypted traffic samples along with their temporal evolution
facilitating an upgrade from instantaneous data capture to sustained knowledge accumulation
while supporting forward knowledge consolidation and backward adaptive optimization for downstream encrypted traffic analysis. Comprehensive evaluations are conducted on real-world datasets covering three representative encrypted traffic analysis tasks (i.e.
internet of things (IoT) device
mobile App
and website identification) across nine mainstream analysis algorithms. Experimental results show that FreshHunter improves the
F
1
-score of downstream encrypted traffic analysis algorithms by approximately 15
% to 60%
outperforming the three baseline traffic selection methods: Random
dynamic time warping (DTW)
and tree shapley additive explanations (TreeSHAP). Even under traffic feature drift scenarios
FreshHunter maintains strong adaptability
improving algorithm performance by around 20%. Overall
this study offers a novel technical pathway for advancing data efficiency and model adaptability in encrypted traffic analysis under resource-constrained conditions.
Antonakakis M , April T , Bailey M , et al . Understanding the mirai botnet [C ] // Proceedings of the 26th USENIX Conference on Security Symposium . Berkeley : USENIX Association , 2017 : 1093 - 1110 .
沙泓州 , 刘庆云 , 柳厅文 , 等 . 恶意网页识别研究综述 [J ] . 计算机学报 , 2016 , 39 ( 3 ): 529 - 542 . DOI: 10.11897/SP.J.1016.2016.00529 http://dx.doi.org/10.11897/SP.J.1016.2016.00529
Sha Hongzhou , Liu Qingyun , Liu Tingwen , et al . Survey on malicious webpage detection research [J ] . Chinese Journal of Computers , 2016 , 39 ( 3 ): 529 - 542 . (in Chinese) . DOI: 10.11897/SP.J.1016.2016.00529 http://dx.doi.org/10.11897/SP.J.1016.2016.00529
李艳 , 王纯子 , 黄光球 , 等 . 网络安全态势感知分析框架与实现方法比较 [J ] . 电子学报 , 2019 , 47 ( 4 ): 927 - 945 .
Li Yan , Wang Chunzi , Huang Guangqiu , et al . A survey of architecture and implementation method on cyber security situation awareness analysis [J ] . Acta Electronica Sinica , 2019 , 47 ( 4 ): 927 - 945 . (in Chinese)
Belson D . Cloudflare 2024 年度回顾 [EB/OL ] . ( 2024-12-09 )[ 2026-02-23 ] . https://blog.cloudflare.com/zh-cn/radar-2024-year-in-review/ https://blog.cloudflare.com/zh-cn/radar-2024-year-in-review/ .
Belson D . Cloudflare 2024 year in review [EB/OL ] . ( 2024-12-09 )[ 2026-02-23 ] . https://blog.cloudflare.com/zh-cn/radar-2024-year-in-review/ https://blog.cloudflare.com/zh-cn/radar-2024-year-in-review/ . (in Chinese)
Zhang Hongli , Lu Gang , Qassrawi M T , et al . Feature selection for optimizing traffic classification [J ] . Computer Communications , 2012 , 35 ( 12 ): 1457 - 1471 . DOI: 10.1016/j.comcom.2012.04.012 http://dx.doi.org/10.1016/j.comcom.2012.04.012
Muschalik M , Fumagalli F , Hammer B , et al . Beyond TreeSHAP: Efficient computation of any-order Shapley interactions for tree ensembles [J ] . Proceedings of the AAAI Conference on Artificial Intelligence. Washington: AAAI Press , 2024 , 38 ( 13 ): 14388 - 14396 . DOI: 10.1609/aaai.v38i13.29352 http://dx.doi.org/10.1609/aaai.v38i13.29352
Silva P R , Vinagre J , Gama J . A DTW approach for complex data a case study with network data streams [C ] // Proceedings of the 38th ACM/SIGAPP Symposium on Applied Computing . New York : ACM , 2023 : 402 - 409 . DOI: 10.1145/3555776.3577638 http://dx.doi.org/10.1145/3555776.3577638
Chung J Y , Park B , Won Y J , et al . An effective similarity metric for application traffic classification [C ] // Proceedings of 2010 IEEE Network Operations and Management Symposium . Piscataway : IEEE , 2010 : 286 - 292 . DOI: 10.1109/noms.2010.5488477 http://dx.doi.org/10.1109/noms.2010.5488477
程光 , 钱德鑫 , 郭建伟 , 等 . 基于散度的网络流概念漂移分类方法 [J ] . 计算机研究与发展 , 2020 , 57 ( 12 ): 2673 - 2682 . DOI: 10.7544/issn1000-1239.2020.20190691 http://dx.doi.org/10.7544/issn1000-1239.2020.20190691
Cheng Guang , Qian Dexin , Guo Jianwei , et al . A classification approach based on divergence for network traffic in presence of concept drift [J ] . Journal of Computer Research and Development , 2020 , 57 ( 12 ): 2673 - 2682 . (in Chinese) . DOI: 10.7544/issn1000-1239.2020.20190691 http://dx.doi.org/10.7544/issn1000-1239.2020.20190691
Google . Google transparency report: HTTPS overview [EB/OL ] . [ 2026-02-23 ] . https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/https/overview .
Cao Zigang , Cao Shoufeng , Xiong Gang , et al . Progress in study of encrypted traffic classification [C ] // Proceedings of the International Conference on Trustworthy Computing and Services . Berlin, Heidelberg : Springer , 2013 : 78 - 86 . DOI: 10.1007/978-3-642-35795-4_10 http://dx.doi.org/10.1007/978-3-642-35795-4_10
Duan Chenxin , Gao Hao , Song Guanglei , et al . ByteIoT: A practical IoT device identification system based on packet length distribution [J ] . IEEE Transactions on Network and Service Management , 2021 , 19 ( 2 ): 1717 - 1728 . DOI: 10.1109/tnsm.2021.3130312 http://dx.doi.org/10.1109/tnsm.2021.3130312
Li Jianfeng , Wu Shuohan , Zhou Hao , et al . Packet-level open-world app fingerprinting on wireless traffic [C ] // Proceedings of the 29th Annual Network and Distributed System Security Symposium . Reston : Internet Society , 2022 : 24210 . DOI: 10.14722/ndss.2022.24210 http://dx.doi.org/10.14722/ndss.2022.24210
Li Jianfeng , Zhou Hao , Wu Shuohan , et al . FOAP: Fine-grained open-world android app fingerprinting [C ] // Proceedings of the 31st USENIX Security Symposium . Berkeley : USENIX Association , 2022 : 1579 - 1596 . DOI: 10.14722/ndss.2022.24210 http://dx.doi.org/10.14722/ndss.2022.24210
Ma Xiaobo , Qu Jian , Li Jianfeng , et al . Pinpointing hidden IoT devices via spatial-temporal traffic fingerprinting [C ] // Proceedings of the IEEE Conference on Computer Communications . Piscataway : IEEE , 2020 : 894 - 903 . DOI: 10.1109/infocom41043.2020.9155346 http://dx.doi.org/10.1109/infocom41043.2020.9155346
Ma Xiaobo , Shi Mawei , An Bingyu , et al . Context-aware website fingerprinting over encrypted proxies [C ] // Proceedings of the IEEE Conference on Computer Communications . Piscataway : IEEE , 2021 : 9488676 . DOI: 10.1109/INFOCOM42981.2021.9488676 http://dx.doi.org/10.1109/INFOCOM42981.2021.9488676
谷勇浩 , 徐昊 , 张晓青 . 基于多粒度表征学习的加密恶意流量检测 [J ] . 计算机学报 , 2023 , 46 ( 9 ): 1888 - 1899 . DOI: 10.11897/SP.J.1016.2023.01888 http://dx.doi.org/10.11897/SP.J.1016.2023.01888
Gu Yonghao , Xu Hao , Zhang Xiaoqing . Multi-granularity representation learning for encrypted malicious traffic detection [J ] . Chinese Journal of Computers , 2023 , 46 ( 9 ): 1888 - 1899 . (in Chinese) . DOI: 10.11897/SP.J.1016.2023.01888 http://dx.doi.org/10.11897/SP.J.1016.2023.01888
李锐光 , 段鹏宇 , 沈蒙 , 等 . 基于随机森林的物联网设备流量分类算法 [J ] . 北京航空航天大学学报 , 2022 , 48 ( 2 ): 233 - 239 . DOI: 10.13700/j.bh.1001-5965.2020.0383 http://dx.doi.org/10.13700/j.bh.1001-5965.2020.0383
Li Ruiguang , Duan Pengyu , Shen Meng , et al . Traffic classification algorithm of Internet of things devices based on random forest [J ] . Journal of Beijing University of Aeronautics and Astronautics , 2022 , 48 ( 2 ): 233 - 239 . (in Chinese) . DOI: 10.13700/j.bh.1001-5965.2020.0383 http://dx.doi.org/10.13700/j.bh.1001-5965.2020.0383
Hao Song , Fu Wentao , Chen Xuanze , et al . Network anomaly traffic detection via multi-view feature fusion [PP/OL ] . V2. arXiv ( 2024-09-12 )[ 2026-02-23 ] . https://arxiv.org/abs/2409.08020 https://arxiv.org/abs/2409.08020 . DOI: 10.20278/j.jc2.2096-0204.2024.0196 http://dx.doi.org/10.20278/j.jc2.2096-0204.2024.0196
Duan Chenxin , Zhang Shize , Yang Jiahai , et al . PINBALL: Universal and robust signature extraction for smart home devices [C ] // Proceedings of 2021 IFIP/IEEE International Symposium on Integrated Network Management . Piscataway : IEEE , 2021 : 1 - 9 .
Dong Shuaike , Li Zhou , Tang Di , et al . Your smart home can’t keep a secret: Towards automated fingerprinting of IoT traffic [C ] // Proceedings of the 15th ACM Asia Conference on Computer and Communications Security . New York : ACM , 2020 : 47 - 59 . DOI: 10.1145/3320269.3384732 http://dx.doi.org/10.1145/3320269.3384732
Sun Yizhen , Fu Shupo , Zhang Shigeng , et al . Accurate IoT device identification from merely packet length [C ] // Proceedings of the 16th International Conference on Mobility, Sensing and Networking . Piscataway : IEEE , 2020 : 774 - 778 . DOI: 10.1109/MSN50589.2020.00132 http://dx.doi.org/10.1109/MSN50589.2020.00132
Trimananda R , Varmarken J , Markopoulou A , et al . Packet-level signatures for smart home devices [C ] // Proceedings of the Network and Distributed System Security Symposium . Reston : Internet Society , 2020 . DOI: 10.14722/ndss.2020.24097 http://dx.doi.org/10.14722/ndss.2020.24097
Pinheiro A J , de M . Bezerra J, Burgardt C A P, et al. Identifying IoT devices and events based on packet length from encrypted traffic[J ] . Computer Communications , 2019 , 144 : 8 - 17 . DOI: 10.1016/j.comcom.2019.05.012 http://dx.doi.org/10.1016/j.comcom.2019.05.012
李小龙 , 李曦 , 刘洋 , 等 . 基于延迟时空依赖的非平稳时间序列交通流量预测模型 [J ] . 电子学报 , 2025 , 53 ( 11 ): 4035 - 4050 .
Li Xiaolong , Li Xi , Liu Yang , et al . Non-stationary time series traffic flow forecasting model based on delayed spatio-temporal dependencies [J ] . Acta Electronica Sinica , 2025 , 53 ( 11 ): 4035 - 4050 . (in Chinese)
Liu Xiangyu , Han Yi , Du Yanhui . IoT device identification using directional packet length sequences and 1D-CNN [J ] . Sensors , 2022 , 22 ( 21 ): 8337 . DOI: 10.3390/s22218337 http://dx.doi.org/10.3390/s22218337
Oh S , Lee M , Lee H , et al . AppSniffer: Towards robust mobile app fingerprinting against VPN [C ] // Proceedings of the ACM Web Conference . New York : ACM , 2023 : 2318 - 2328 . DOI: 10.1145/3543507.3583473 http://dx.doi.org/10.1145/3543507.3583473
孙学良 , 黄安欣 , 罗夏朴 , 等 . 针对Tor的网页指纹识别研究综述 [J ] . 计算机研究与发展 , 2021 , 58 ( 8 ): 1773 - 1788 . DOI: 10.7544/issn1000-1239.2021.20200498 http://dx.doi.org/10.7544/issn1000-1239.2021.20200498
Sun Xueliang , Huang Anxin , Luo Xiapu , et al . Webpage fingerprinting identification on Tor: A survey [J ] . Journal of Computer Research and Development , 2021 , 58 ( 8 ): 1773 - 1788 . (in Chinese) . DOI: 10.7544/issn1000-1239.2021.20200498 http://dx.doi.org/10.7544/issn1000-1239.2021.20200498
Williams M , Morales R , Johnson K , et al . Entropy-based network traffic analysis for efficient ransomware detection [EB/OL ] . ( 2024-10-08 )[ 2026-02-24 ] . https://doi.org/10.36227/techrxiv.172840776.66718131/v1 https://doi.org/10.36227/techrxiv.172840776.66718131/v1 .
NetFlow analyzer [EB/OL ] . [ 2026-02-23 ] . https://www.manageengine.com/products/netflow/ https://www.manageengine.com/products/netflow/ . DOI: 10.71097/ijsat.v16.i2.5974 http://dx.doi.org/10.71097/ijsat.v16.i2.5974
sFlow analyzer [EB/OL ] . [ 2026-02-23 ] . https://www.manageengine.com/products/netflow/sflow-analyzer.html https://www.manageengine.com/products/netflow/sflow-analyzer.html . DOI: 10.17504/protocols.io.5jyl8mxwrg2w/v4 http://dx.doi.org/10.17504/protocols.io.5jyl8mxwrg2w/v4
Vollmer M . Newton’s law of cooling revisited [J ] . European Journal of Physics , 2009 , 30 ( 5 ): 1063 - 1084 . DOI: 10.1088/0143-0807/30/5/014 http://dx.doi.org/10.1088/0143-0807/30/5/014
Manias D M , Chouman A L , Shami A . Model drift in dynamic networks [J ] . IEEE Communications Magazine , 2023 , 61 ( 10 ): 78 - 84 . DOI: 10.1109/mcom.003.2200306 http://dx.doi.org/10.1109/mcom.003.2200306
Pashamokhtari A , Okui N , Nakahara M , et al . Dynamic inference from IoT traffic flows under concept drifts in residential ISP networks [J ] . IEEE Internet of Things Journal , 2023 , 10 ( 17 ): 15761 - 15773 . DOI: 10.1109/jiot.2023.3265012 http://dx.doi.org/10.1109/jiot.2023.3265012
Sivanathan A , Gharakheili H H , Loi F , et al . Classifying IoT devices in smart environments using network traffic characteristics [J ] . IEEE Transactions on Mobile Computing , 2019 , 18 ( 8 ): 1745 - 1759 . DOI: 10.1109/tmc.2018.2866249 http://dx.doi.org/10.1109/tmc.2018.2866249
Shahid M R , Blanc G , Zhang Zonghua , et al . IoT devices recognition through network traffic analysis [C ] // Proceedings of 2018 IEEE International Conference on Big Data . Piscataway : IEEE , 2018 : 5187 - 5192 . DOI: 10.1109/bigdata.2018.8622243 http://dx.doi.org/10.1109/bigdata.2018.8622243
Wang Tao , Cai Xiang , Nithyanand R , et al . Effective attacks and provable defenses for website fingerprinting [C ] // Proceedings of the 23rd USENIX Security Symposium . Berkeley : USENIX Association , 2014 : 143 - 157 .
Rimmer V , Preuveneers D , Juarez M , et al . Automated website fingerprinting through deep learning [C ] // Proceedings of the 25th Annual Network and Distributed System Security Symposium . Reston : Internet Society , 2018 : 1 - 15 . DOI: 10.14722/ndss.2018.23105 http://dx.doi.org/10.14722/ndss.2018.23105
Kolcun R , Popescu D A , Safronov V , et al . Revisiting IoT device identification [C ] // Proceedings of the 5th Network Traffic Measurement and Analysis Conference . TMA , 2021 . DOI: 10.48550/arXiv.2107.07818 http://dx.doi.org/10.48550/arXiv.2107.07818
Taylor V F , Spolaor R , Conti M , et al . AppScanner: Automatic fingerprinting of smartphone apps from encrypted network traffic [C ] // Proceedings of 2016 IEEE European Symposium on Security and Privacy . Piscataway : IEEE , 2016 : 439 - 454 . DOI: 10.1109/eurosp.2016.40 http://dx.doi.org/10.1109/eurosp.2016.40
Aceto G , Ciuonzo D , Montieri A , et al . Traffic classification of mobile apps through multi-classification [C ] // Proceedings of 2017 IEEE Global Communications Conference . Piscataway : IEEE , 2017 : 8254059 . DOI: 10.1109/glocom.2017.8254059 http://dx.doi.org/10.1109/glocom.2017.8254059
Hayes J , Danezis G . k-fingerprinting: A robust scalable website fingerprinting technique [C ] // Proceedings of the 25th USENIX Conference on Security Symposium . Berkeley : USENIX Association , 2016 : 1187 - 1203 .
Sirinam P , Imani M , Juarez M , et al . Deep fingerprinting: Undermining website fingerprinting defenses with deep learning [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2018 : 1928 - 1943 . DOI: 10.1145/3243734.3243768 http://dx.doi.org/10.1145/3243734.3243768
Shen Meng , Ji Kexin , Gao Zhenbo , et al . Subverting website fingerprinting defenses with robust traffic representation [C ] // Proceedings of the 32nd USENIX Conference on Security Symposium . Berkeley : USENIX Association , 2023 : 607 - 624 .
0
浏览量
14
下载量
0
CSCD
关联资源
相关文章
相关作者
相关机构
京公网安备11010802024621