NetCoFi: A Budget-Aware Coarse-Fine Dual-Branch Model for Encrypted Traffic Classification

NetCoFi: A Budget-Aware Coarse-Fine Dual-Branch Model for Encrypted Traffic Classification Zhengyi Ma1,† , Qiming Yu2,† , Chungang Lin3,4 , Wentao Cui1 , Zijia Song2 , Guozheng Yang2,*

arXiv:2610.17978v1 [cs.NI] 13 Oct 2026

1

College of Computer Science and Technology, National University of Defense Technology, Changsha 410073, China 2 College of Electronic Engineering, National University of Defense Technology, Hefei 230007, China 3 Institute of Computing Technology, Chinese Academy of Sciences, China 4 University of Chinese Academy of Sciences, China

Abstract—Encrypted traffic classification is critical for network management and security, but practical deployment must balance classification accuracy and inference cost. Existing models typically process fixed flow windows with limited control over computation after training, which can limit the accuracy–efficiency trade-off under constrained resources. To address this problem, we present NetCoFi, a budget-aware classifier that allocates computation at coarse and fine granularities. Using byte representations and observable packet metadata, NetCoFi selects token neighborhoods for fine-grained encoding while compressing the full window into complementary coarse context. Multi-budget training enables the same model to operate at different routing budgets without retraining. Evaluation on six public datasets shows that NetCoFi achieves state-of-the-art classification performance when trained from scratch. Under low-budget settings, NetCoFi improves average Macro-F1 by 7.86 percentage points across three datasets, compared with a same-depth static baseline. In a DPDK–GPU traffic processing pipeline, it increases mean batch throughput from 26.42 to 43.42 Mb/s, a 1.64× improvement over NetMamba. Index Terms—Encrypted traffic classification, Mamba, adaptive token routing, budget-aware inference

Fig. 1. Illustration of sparse discriminative regions in encrypted traffic and the localized byte-level semantics that motivate compute-aware routing.

encoders reduce the computational complexity of long-sequence modeling compared with standard self-attention [11], [12]. Efficient encrypted traffic classification is an important However, many classifiers still process fixed traffic windows capability for network management and security monitoring, along fixed computation paths. Once trained, these models supporting application identification and traffic analysis [1]– use a fixed computation path for every prediction, regardless [3]. As TLS and encrypted tunnels become widely used, of input complexity or available resources. Shortening the plaintext payload semantics are increasingly unavailable, forc- input window can reduce this cost, but it also removes traffic ing classifiers to infer traffic classes from observable byte information before the model can assess its value. A more sequences and packet-level metadata [3], [4]. At the same flexible alternative is to adjust the amount of computation time, practical deployment must meet latency and throughput within the window instead of relying only on a shorter input. constraints. This raises a key question: how to ensure that the Such an approach must balance local detail with global classifier, given limited inference resources, can retain sufficient context. Regions within a flow window may contribute untraffic information to make accurate predictions while avoiding equally to classification. Processing all regions at the same computational waste? granularity can waste computation on those that provide little Recent studies have improved encrypted traffic classification useful information. However, a region that is less informative on through advances in representation learning and sequence its own may still provide context for other parts of the window. modeling. End-to-end models learn features directly from Discarding it entirely can therefore remove information that traffic data and reduce reliance on manual feature design [5]. supports the final prediction. NetCoFi therefore concentrates Pretrained models use unlabeled traffic to learn representations fine-grained processing on informative regions, while retaining that can be adapted to downstream classification tasks [6]– a global summary of the full window. [8]. More recently, Mamba-based classifiers have improved We propose NetCoFi, a budget-aware coarse-fine dual-branch backbone efficiency with state-space encoders [9], [10]. These classifier for fixed-window encrypted traffic classification. It † These authors contributed equally to this work. estimates token importance from byte representations and * The corresponding author is Guozheng Yang. token-aligned side features derived from packet metadata. The I. I NTRODUCTION

fine branch encodes selected token neighborhoods in detail. from large amounts of unlabeled data [6], [17]. YaTC and FlowIncluding neighboring tokens preserves local context around MAE further introduce masked modeling and autoencoding the selected positions. The coarse branch compresses the full objectives [7], [8]. These methods improve traffic representation window, including regions not selected by the fine branch. quality, but their main goal is classification performance or It provides broader context without applying fine-grained transferability. They do not explicitly control inference cost encoding to every region. The two branch representations are after training. then fused for classification. Changing the routing budget also changes the information B. Efficient Encrypted Traffic Classification Existing studies reduce the cost of encrypted traffic classificaavailable to the classifier. A model trained only at full budget may lose accuracy when less detail is retained. We therefore tion through lightweight architectures and sequence modeling. train NetCoFi under multiple routing budgets with shared Compact temporal models and lightweight graph encoders parameters. This exposes the model to different levels of reduce model complexity [18], [19]. However, these methods detail during training. At inference time, the user can choose generally retain a fixed computation path during inference. State-space models provide another direction for efficient a budget according to the available computational resources. The same model then provides different accuracy–efficiency sequence modeling. Mamba reduces the complexity of longsequence modeling compared with standard self-attention [11], choices without retraining. We evaluate NetCoFi on six public benchmarks and in a [12]. NetMamba and PaT apply Mamba-style architectures to DPDK–GPU traffic processing pipeline. In the low-budget encrypted traffic analysis [9], [10]. Their efficiency mainly comparison, it outperforms a same-depth static token-reduction comes from the backbone architecture. The input window is baseline. The average Macro-F1 gain is 7.86 percentage points still processed with a largely fixed computational workload. across three datasets. In the deployment pipeline, its mean batch In contrast, NetCoFi focuses on how computation is allocated throughput reaches 43.42 Mb/s, compared with 26.42 Mb/s within a fixed traffic window under different routing budgets. for NetMamba. This throughput comparison includes flow C. Adaptive Computation and Budget-Aware Routing aggregation and feature construction, rather than measuring Conditional computation dynamically allocates resources model inference alone. according to input content. Existing vision and language models In summary, this paper makes the following contributions: use token pruning or adaptive routing to reduce redundant 1) We propose NetCoFi, a coarse-fine dual-branch model for computation [20]–[26]. Other methods dynamically select encrypted traffic classification. It allocates fine-grained layers or model paths [27]–[31]. These approaches avoid computation to informative local regions, while preserving applying the same amount of computation to all inputs or global context through a coarse branch. token regions. As a result, they can reduce inference cost 2) We introduce a budget-aware training strategy. It allows while preserving important information, and provide a more one shared model to operate under different routing flexible accuracy–efficiency trade-off under different resource budgets without retraining. This provides a flexible constraints. accuracy–efficiency trade-off under different resource Dynamic computation has received less attention in enconstraints. crypted traffic classification. FastFlow dynamically determines 3) We evaluate NetCoFi on six public datasets and in a how many packets should be observed, while pForest switches DPDK–GPU deployment pipeline. NetCoFi achieves commodels according to different flow stages [32], [33]. Their petitive classification performance, stronger low-budget decisions are mainly made at the packet, flow-stage, or modelaccuracy, and higher deployment throughput than Netpath level. By contrast, NetCoFi allocates computation among Mamba. token regions within a fixed flow window. It combines fineII. R ELATED W ORK grained processing of informative regions with coarse-grained A. Encrypted Traffic Classification global context under a controllable routing budget. Encrypted traffic classification typically relies on side chanIII. M ETHOD nel information, such as packet length, direction, header fields, and handshake metadata, rather than plaintext payloads [1]–[4]. A. Method Overview NetCoFi is a budget-aware coarse-fine dual-branch classifier Early methods such as AppScanner and FlowPrint use statistical or side-channel fingerprints for application identification [13], designed to concentrate computation on informative tokens [14]. Deep learning methods further reduce the dependence on while preserving complementary global context. As illustrated handcrafted features by learning discriminative representations in Fig. 2, the input byte stream is first tokenized into stride directly from traffic data. Deep Packet, FS-Net, and TFE- tokens X0 ∈ RN ×d . From X0 and token-aligned side features s, GNN model raw bytes or structural relationships in traffic, NetCoFi computes token importance scores a = [a1 , . . . , aN ]. allowing classifiers to capture both local patterns and longer- The user-specified routing budget ρ is then resolved into (keff , reff , Ceff ), which determine the seed-token budget, the range dependencies [5], [15], [16]. Recent studies increasingly use self-supervised learning and budget-resolved neighborhood radius, and the coarse-token pretraining. PERT and ET-BERT learn traffic representations budget. The fine branch processes the selected seed tokens

Fig. 2. NetCoFi architecture. Budget-aware routing constructs fine-grained token neighborhoods and compressed coarse context. Two Mamba branches encode these representations, which are combined through cross-gated fusion.

Algorithm 1: NetCoFi Inference Forward Pass Lb

Input: flow-window byte array b ∈ {0, . . . , 255} , token-aligned side features s ∈ RN ×ds , routing budget ρ ∈ [ρmin , ρmax ] Output: logits z ∈ RC , predicted label ŷ X0 ← StrideEmbed(b); a ← [σ(f ([Norm(xt ), Norm(st )]))]N t=1 ; 3: (keff , reff , Ceff ) ← BudgetResolver(ρ); 4: Iseed ← TopK(a, keff ); 5: if EnableExpand then 6: rused eff ← reff ; 1: 2:

else 8: rused eff ← 0;

7:

Isel ← Expand(Iseed , rused eff ); f 10: X ← Gather(X0 , Isel ); c 11: X ← WPool(X0 , 1 − a, Ceff ); f f f 12: H ← Enc (X ); c c c 13: H ← Enc (X ); c c 14: u ← Pool(H ); 15: if EnableCrossGate then 16: q ← σ(MLPgate (uc )); 17: H̃ f ← H f ⊙ q; 9:

else 19: H̃ f ← H f ;

For each flow, we extract the first M packets. Header and payload bytes are truncated or padded to Bh and Bp bytes per packet. We concatenate these regions in packet order to form b ∈ {0, . . . , 255}Lb , where Lb = M (Bh + Bp ). The default configuration uses M = 5, Bh = 80, and Bp = 240, giving Lb = 1600. A one-dimensional convolution with stride p projects the byte sequence into token embeddings: X0 = StrideEmbed(b) ∈ RN ×d ,

where N = Lb /p and d is the embedding dimension. Each token xt is paired with a side feature vector st ∈ Rds , yielding s = [s1 , . . . , sN ]. Packet and region descriptors are derived from the byte positions covered by each token. These descriptors identify the corresponding packet, header or payload region, and relative position. Table I summarizes the side features. Continuous features are normalized using training-set statistics. The same transformation is applied to validation and test data. TABLE I T OKEN - ALIGNED SIDE FEATURES USED IN N ET C O F I .

18:

f

f

u ← Pool(H̃ ); z ← Wf [uf ; uc ] + bf ; 22: ŷ ← arg maxc zc ; 23: return z, ŷ; 20:

21:

together with their budget-resolved neighborhoods, whereas the coarse branch compresses the full sequence into complementary coarse context through anti-importance weighted pooling. The two branch representations are finally combined by cross-gated fusion to produce logits z ∈ RC . Algorithm 1 summarizes the NetCoFi inference forward pass used throughout our experiments. B. Input Representation and Side Features We consider supervised encrypted traffic classification on a labeled dataset D. Each sample consists of an input x = (b, s) and a label y ∈ {1, . . . , C}. Here, b is a fixed-length byte sequence, and s contains token-aligned side features.

(1)

# 1 2 3 4–11 12 13 14 15 16 17 18 19 20

Name log dt pkt len norm direction bin syn, ack, rst, fin, psh, urg, ece, cwr is tcp delta len norm dir switch pkt pos norm tok pos norm is header token header pos norm log local rate dt z dataset

Description log(1 + ∆t) inter-packet gap normalized packet length direction indicator (uplink/downlink) TCP flag indicators TCP indicator normalized length difference to previous packet whether direction switches vs previous packet normalized packet index within the prefix normalized token index within a packet whether the token belongs to header region normalized position within header region log(1 + len/∆t) local rate proxy dataset-level z-score of log dt

C. Budgeted Coarse-Fine Routing Rather than allocating computation uniformly across all stride tokens, NetCoFi learns an importance map and uses it to construct complementary fine and coarse sequences. a) Importance scoring: Given X0 = [x1 , . . . , xN ] and token-aligned side features s = [s1 , . . . , sN ], the importance scores are computed as
at = σ f ([Norm(xt ), Norm(st )]) ∈ (0, 1), t = 1, . . . , N, (2)

where f (·) is a lightweight multi-layer perceptron applied WPool is implemented as weighted adaptive average pooling to the concatenation of normalized projections of the token over contiguous bins, where each output token is the weighted embedding and the side feature. These scores are shared by mean of the tokens assigned to that bin. both branches: they drive fixed-k seed selection in the fine D. Dual-Branch Encoding and Cross-Gated Fusion branch and anti-importance weighting in the coarse branch. b) Budget resolver: We use a routing budget ρ ∈ After routing constructs X f and X c , NetCoFi encodes the [ρmin , ρmax ] ⊆ [0, 1]. The default interval is [0, 1]. The user two sequences with separate Mamba-style encoders: specifies ρ at inference time to control the routing workload. H f = Encf (X f ) ∈ RNf ×d , H c = Encc (X c ) ∈ RNc ×d . This value is not a literal fraction of raw tokens retained. The (9) full routing configuration corresponds to ρ = 1.0. A deterministic resolver maps ρ to (keff , reff , Ceff ). These The coarse summary generates a channel-wise gate for the variables determine the seed-token count, neighborhood radius, fine states. The pooled branch outputs are then concatenated and coarse-token count, respectively. Let K0 and C0 denote for classification: the maximum seed-token and coarse-token counts at ρ = 1.0. uc = Pool(H c ), The main configuration uses K0 = 64 and C0 = 100. The q = σ(MLPgate (uc )) ∈ (0, 1)d , token counts follow H̃ f = H f ⊙ q, (10) keff = round(K0 ·ρ), Ceff = max{1, round(C0 ·ρ)}. (3) f f u = Pool(H̃ ), We set rcap = min{focal r, budget r max}. The neighborz = Wf [uf ; uc ] + bf . hood radius follows  This cross-gated fusion preserves the fine branch as the  ρ ≥ 0.75, rcap , discriminative local pathway while allowing coarse global reff = max{1, rcap − 1}, 0.50 ≤ ρ < 0.75, (4) context to condition the final fine-token summary before   0, ρ < 0.50. classification. The main configuration uses focal r = budget r max = 2. used With neighborhood expansion enabled, reff = reff . Otherwise, E. Multi-Budget Training Objective used reff = 0. We train one shared model fθ across multiple routing budgets. c) Fine-token construction: Using this routing tuple, the For each mini-batch Bt , we sample the two endpoint budgets fine branch first selects exactly keff seed tokens via fixed-k and Q intermediate budgets: routing: St = {ρmax , ρmin , ut,1 , . . . , ut,Q }, Ikeff = TopK(a, keff ). (5) (11) ut,q ∼ Uniform[ρmin , ρmax ], Each selected seed is then expanded in token-index space using used To further stabilize low-budget predictions, we optionally the applied neighborhood radius reff , i.e., over adjacent stride tokens rather than raw bytes. This yields the fine-token index use the full-budget model as an online teacher. Let fθ (·; 1.0) denote the teacher prediction. For each reduced budget ρ < 1, set [ we apply used If = { j | |j − i| ≤ reff , 1 ≤ j ≤ N }. (6)  (ρ) 2 i∈Ikeff Lkd = Tkd KL softmax(fθ (x; 1.0)/Tkd )  (12) The fine-token sequence is then formed by gathering the ∥ softmax(fθ (x; ρ)/Tkd ) , expanded neighborhoods from X0 while preserving the implementation order used by the fine branch: which encourages lower-budget predictors to match the preX f = Gather(X0 , I f ) ∈ RNf ×d ,

(7)

Here Nf is the gathered input length processed by the fine encoder. It includes neighborhood expansion and is not a deduplicated count of unique tokens. d) Coarse-token construction: To preserve complementary global context while concentrating fine-grained computation on the routed region, we pool the full token stream into Nc = Ceff coarse tokens. Let w = 1 − a denote the antiimportance weights. A weighted pooling operator WPool(·) aggregates information along the sequence dimension and produces a fixed-length token sequence: X c = WPool(X0 , w, Nc ) ∈ RNc ×d .

(8)

dictive distribution of the full-budget model. We stop the gradient through the full-budget teacher distribution. We set (1.0) Lkd = 0 for the full-budget pass. In addition, because routing is controlled by the explicit routing budget, we regularize the importance scores so that the realized routing tendency remains calibrated to the requested budget. Let a(x) = [a1 , . . . , aN ] be the importance scores from Eq. (2), and let N ′ denote the effective token length to which the routing budget is applied (N ′ = N in the default setting without pre-subsampling). We define  2 N′ X keff 1 (ρ) ρ⋆ (ρ) = ′ , Lbudget =  ′ at − ρ⋆ (ρ) . (13) N N t=1

This budget-regularization term encourages the mean importance level to track the target seed-token ratio implied by ρ, thereby reducing routing drift across operating points. The final objective is h (ρ) min E(x,y) Eρ ℓ(fθ (x; ρ), y) + λkd Lkd θ i (14) (ρ) + λbudget Lbudget .

fine- and coarse-branch encoders. The routing modules are randomly initialized before downstream multi-budget training. This separates the comparison without pretraining from the evaluation of pretrained representations. c) Metrics: We report Accuracy (AC) and Macro-F1 (F1) for classification. Efficiency is evaluated using inference latency, throughput, and peak GPU memory. Throughput is reported in samples/s for model inference and Mb/s for the deployment The expectation over ρ is approximated by averaging over the pipeline. d) Implementation Details: Experiments use PyTorch sandwich budget set St in Eq. (11). 2.8.0 with CUDA 12.8 on NVIDIA GeForce RTX 4090 GPUs. Training exposes the shared model to both endpoint and We train NetCoFi in FP32 with AdamW for 100 epochs. The intermediate budgets. At inference time, the routing budget batch size is 64, the initial learning rate is 2.5 × 10−4 , and can be changed without retraining. Section IV-C evaluates the weight decay is 0.05. The learning rate warms up linearly for resulting accuracy–efficiency trade-off. the first 20 epochs. Multi-budget training covers ρ ∈ [0, 1]. Each mini-batch IV. E VALUATION uses both endpoints and two uniformly sampled intermediate A. Experimental Setup budgets. The full-budget pass at ρ = 1.0 provides the distillaa) Datasets: We evaluate six public datasets. CipherSpec- tion targets. We set Tkd = 2.0, λkd = 0.5, and λbudget = 0.1. trum [4] contains 120,000 TLS 1.3 sessions from 40 domains. Routing budgets are specified in the corresponding experiments. We use 40,020 flows from 120 applications in CSTNETTLS1.3 [34]. The other four datasets provide legacy application B. Overall Performance and malicious-traffic benchmarks. For ISCXTOR2016 [35] and Table II compares classification performance without preISCXVPN2016 [36], we use class-balanced subsets of 23,605 training. NetCoFi achieves the highest Macro-F1 on all six and 48,456 flows, respectively. We select 10,000 flows from datasets, also the highest Accuracy on five datasets. USTC-TFC2016 [37] through class-stratified sampling. This On CSTNET-TLS1.3, NetCoFi outperforms PaT by 4.15 subset covers 20 benign and malware classes. We also use percentage points in Accuracy and 1.97 points in Macro-F1. 10,000 flows from CTU-13 [38] for seven-class botnet traffic On CTU-13, the corresponding gains over PaT are 2.04 and classification. 1.68 points. The improvements cover both TLS application Datasets are split into an 8:1:1 training-validation-test split. identification and botnet traffic classification. They also appear CTU-13 uses capture-disjoint partitions with proportional in both overall accuracy and class-averaged performance. sampling to preserve class proportions. All samples from one NetCoFi therefore combines budget flexibility with strong capture remain in the same subset. Input construction follows classification performance. Sec. III-B. Table III reports results after pretraining on the same unlab) Baselines: We compare NetCoFi with nine reprebeled corpus. NetCoFi achieves the highest Macro-F1 on four sentative methods in Table II. AppScanner [13] identifies of the six datasets. It also leads in Accuracy on ISCXTOR2016, applications using statistical traffic features. FlowPrint [14] CTU-13, and CipherSpectrum. On CipherSpectrum, pretraining builds application fingerprints from temporal correlations raises its Macro-F1 from 45.16% to 61.69%. This shows that among network flows. These methods provide comparisons NetCoFi can benefit from pretrained representations. with feature-based and fingerprint-based classification. ET-BERT leads on USTC-TFC2016, while PaT leads on The neural baselines cover several ways of modeling traffic. CSTNET-TLS1.3. NetCoFi remains competitive in this setting, Deep Packet [15] learns features directly from packet bytes. although its advantage is more consistent without pretraining. FS-Net [5] uses an encoder–decoder network to capture sequential patterns within flows. TFE-GNN [16] constructs C. Budget-Conditioned Inference and Efficiency byte-level graphs and learns relationships between header and We examine how the routing budget affects classification payload bytes. ET-BERT [6] uses a bidirectional Transformer to learn contextual traffic representations. YaTC [7] combines performance and inference cost. We also compare training a multi-level flow representation with masked autoencoding. strategies and measure token counts, throughput, and GPU NetMamba [9] and PaT [10] provide Mamba-based baselines memory usage. We first show the resulting accuracy–latency for efficient sequence modeling. The latter two help assess frontier, then check budget fidelity, analyze the effect of whether NetCoFi offers benefits beyond using an efficient sandwich-style multi-budget training, and finally report the speed–memory operating points. backbone. The main comparison trains all neural models from ran1) Accuracy–Latency Trade-off: Figure 3 shows Macro-F1 dom initialization. We also evaluate pretrained models in and batch latency at different routing budgets. NetMamba Table III. All models in this comparison use the same provides a fixed reference, while NetCoFi offers several choices unlabeled pretraining corpus. For NetCoFi, we pretrain the with the same trained model. Macro-F1 rises sharply as ρ

TABLE II P ERFORMANCE COMPARISON OF DIFFERENT METHODS ACROSS SIX DATASETS .

ISCXTOR2016

ISCXVPN2016

USTC-TFC2016

AC

F1

AC

F1

AC

F1

AC

AppScanner [13] FlowPrint [14]

41.00 30.90

25.85 16.16

77.20 29.30

75.30 25.80

68.20 25.40

69.36 15.68

FS-Net [5] TFE-GNN [16] DeepPacket [15]

70.27 75.98 72.56

71.80 76.84 71.32

72.85 84.80 85.98

74.44 84.59 83.31

44.68 96.50 93.24

ET-BERT [6] YaTC [7] NetMamba [9] PaT [10]

92.11 90.24 92.69 93.56

92.76 90.27 91.35 92.50

90.76 87.91 87.59 85.33

84.35 86.93 87.50 87.93

NetCoFi

94.13

92.81

91.95

91.92

Method

CTU-13

CSTNET-TLS1.3

CipherSpectrum

F1

AC

F1

AC

F1

16.32 56.36

15.38 57.43

14.78 21.68

15.98 10.56

7.21 7.39

5.95 5.82

29.00 96.23 93.78

39.80 50.30 53.87

34.78 45.78 43.95

16.70 49.30 30.21

10.38 45.28 30.16

6.91 7.44 8.32

4.98 5.00 8.11

94.30 95.69 97.12 97.35

94.23 95.41 96.80 96.39

70.70 80.65 82.32 83.16

69.65 69.56 71.74 73.11

54.07 60.33 79.53 81.22

52.87 55.33 75.08 80.78

30.27 45.28 49.48 48.97

30.98 40.33 44.78 44.29

97.14

97.01

85.20

74.79

85.37

82.75

51.19

45.16

TABLE III P RETRAINED PERFORMANCE COMPARISON ACROSS SIX DATASETS .

ISCXTOR2016

ISCXVPN2016

USTC-TFC2016

CTU-13

CSTNET-TLS1.3

CipherSpectrum

AC

F1

AC

F1

AC

F1

AC

F1

AC

F1

AC

F1

ET-BERT [6] YaTC [7] NetMamba [9] PaT [10]

92.78 95.22 95.01 95.12

92.85 94.44 94.11 94.31

92.95 93.16 94.00 94.50

91.98 93.18 93.89 94.29

98.10 97.67 97.86 97.31

98.22 97.52 97.94 97.27

70.90 82.92 85.30 85.31

70.55 72.86 74.31 73.98

60.54 88.98 89.98 91.23

59.07 87.61 89.78 90.50

50.99 62.91 70.89 71.00

44.99 50.99 60.78 61.20

NetCoFi

95.44

94.48

94.38

94.40

97.54

97.38

85.60

74.51

90.96

89.35

71.90

61.69

Method

Fig. 3. Budget behavior and operating frontier of NetCoFi. (a, b) Budget-response curves under deterministic fixed-k seed routing: Macro-F1 (a) and latency (b) versus routing budget ρ, with NetMamba as a horizontal reference in both panels. (c) Operating points in the latency–Macro-F1 plane

increases from 0.1 to 0.3. Further budget increases bring smaller Full-budget training loses substantial Macro-F1 when the changes in Macro-F1 but generally increase latency. Routing budget is reduced. Discrete-budget training performs At the tested budgets between ρ = 0.3 and 0.8, NetCoFi better near its training budgets but shows sharp drops at interachieves higher Macro-F1 and lower batch latency than mediate values. Sandwich-style training produces a smoother NetMamba. Reducing the budget further causes a substantial curve and stronger performance at reduced budgets. This shows loss in classification performance. These results identify a why training across different budgets is useful: the model must useful middle range where NetCoFi reduces inference cost learn to classify with different amounts of retained detail. while retaining strong classification performance. 4) Speed–Memory Trade-off: We measure latency and 2) Budget Calibration and Budget Fidelity: We next inspect throughput at batch size 64 after warm-up. Repeated forward the token sequences passed to the two encoders. The fine-token passes use CUDA synchronization. The measurements include count includes the gathered neighborhoods after expansion, token selection and routing but exclude data loading. rather than only unique token positions. The coarse-token count is Ceff , and the total is the sum of both branch lengths.

Fig. 6. Inference speed and GPU memory usage at batch size 64. NetCoFi is shown at multiple routing budgets, while competing methods appear as static operating points. Fig. 4. Budget calibration curves under the current fixed-k implementation. As the routing budget ρ increases, the mean coarse-token count grows nearly linearly, while the mean fine-token count and mean total token count increase smoothly and monotonically.

Figure 4 shows that the coarse-token count grows nearly linearly with ρ. The fine and total counts also increase as the budget rises. The fine-token count reflects both seed selection and neighborhood expansion.

At ρ = 1.0, NetCoFi has throughput close to NetMamba but uses more GPU memory. Reducing ρ increases throughput and lowers memory usage, as shown in Fig. 6. The settings at ρ = 0.75 and 0.3 illustrate this change with the same trained model. D. Adaptive vs. Static Token Usage We compare NetCoFi with a static token-reduction version of NetMamba. Both use the same backbone depth. The static baseline uses a fixed 120-byte input, while NetCoFi uses ρ = 0.3. This comparison tests adaptive routing with coarse context against fixed input reduction. TABLE IV C OMPARISON WITH A STATIC TOKEN - REDUCTION BASELINE IN THE LOW- BUDGET REGIME . Dataset

NetMamba

NetCoFi

ISCXVPN2016 CTU-13 CSTNET-TLS1.3

82.30 67.43 69.15

86.19 72.69 83.57

Average

72.96

80.82

Fig. 5. Effect of the budget-training strategy on performance across the evaluated routing budgets.

Note NetMamba uses a static 120B token-reduction baseline; NetCoFi is evaluated at ρ = 0.3.

3) Effect of Multi-Budget Training: Figure 5 compares three training strategies. Full-budget training uses only ρ = 1.0. Discrete-budget training uses {0.25, 0.5, 0.75, 1.0}. Sandwichstyle training uses both endpoints and random intermediate budgets in each update.

Table IV shows that NetCoFi outperforms the static baseline on all three datasets. Macro-F1 improves by 3.89 percentage points on ISCXVPN2016, 5.26 on CTU-13, and 14.42 on CSTNET-TLS1.3. The average rises from 72.96% to 80.82%, a gain of 7.86 percentage points. These results favor NetCoFi’s

TABLE V S TRUCTURAL ABLATION OF N ET C O F I ON TWO REPRESENTATIVE DATASETS . Variant

CSTNET-TLS1.3

TABLE VI P ER - FLOW SPLIT RESULTS UNDER PACKET- LEVEL AND FLOW- LEVEL CLASSIFICATION TASKS .

CTU-13

AC

F1

AC

F1

Full NetCoFi Fine-only Coarse-only

85.37 83.00 74.28

82.75 80.29 70.73

85.20 82.10 76.07

74.79 69.18 68.02

Fixed ROI Random ROI No SideFeature Uniform WPool No Expand

78.02 75.99 79.38 74.28 80.75

74.97 73.19 74.37 71.69 77.85

76.27 75.67 74.38 76.17 82.62

68.03 67.71 66.59 67.40 72.98

No CrossGate

83.75

81.19

84.41

74.45

selective fine-grained processing with coarse context over a fixed shortened input.

VPN-app (16) TLS-120 Model (Per-flow split) Packet-level Flow-level Packet-level Flow-level AC

F1

AC

F1

AC

F1

AC

F1

ET-BERT YaTC NetMamba

82.1 78.9 79.6

68.6 63.2 65.2

57.4 52.5 27.1 58.3 52.6 33.0 52.0 48.1 33.8

20.8 26.2 29.1

54.2 50.5 77.3 74.8 73.8 71.1

NetCoFi

81.6

67.6

53.5 49.3 37.5

32.4

78.2 75.7

TLS1.3 and 0.34 points on CTU-13. This suggests that the fine branch benefits from modulation by coarse contextual summaries, while also indicating that CrossGate is one contributing component. F. Analysis under Strict Split Strategies

E. Structural Ablation

In encrypted traffic classification, the split strategy has a We perform controlled structural ablations to identify how direct effect on how reliable the evaluation is. Packet-level the main components contribute to NetCoFi. All variants in splitting can assign packets from the same session to different Table V use the same data split and training protocol. To subsets, allowing a model to exploit fields shared within a avoid conflating structural effects with compute allocation, all session or highly correlated across packets from the same ablations use the same budget setting (ρ = 1.0), and each session. This can introduce shortcut learning. Per-flow split variant changes only the target component while keeping the is stricter because all packets from a given flow are assigned other hyperparameters fixed. exclusively to one subset, making the evaluation closer to 1) Core Coarse-Fine Dual-Branch Architecture: We first real-world scenarios on unseen flows. examine the contribution of the coarse-fine dual-branch arVPN-app (16) and TLS-120 are auxiliary benchmarks chitecture. As shown in Table V, the full model outperforms used only in this strict-split analysis, not additional datasets both single-branch variants on CSTNET-TLS1.3 and CTU- in the main six-benchmark comparison. They correspond 13. Fine-only consistently performs better than Coarse-only, to a 16-class VPN application task and a 120-class TLS showing that fine-grained token modeling remains the main application task, respectively. To evaluate generalization under discriminative pathway. Adding the coarse branch further this stricter protocol, we construct both flow-level and packetimproves Macro-F1 by 2.46 percentage points on CSTNET- level classification tasks on VPN-app and TLS-120, and adopt TLS1.3 and 5.61 points on CTU-13. This indicates that flow-level splitting as the primary isolation strategy. The flow compressed global context provides complementary information is the unit of data isolation. Both a flow and its constituent to the fine branch. packets inherit the same label. In packet-level classification, 2) Routing and Context Construction: The second group each training sample is still a single packet, but the training, studies whether the routing pipeline matters beyond sparse validation, and test sets are first partitioned at the flow level token selection. Fixed ROI and Random ROI degrade per- so that packets from the same flow appear in only one subset. formance relative to the full model, supporting the need for This prevents explicit or implicit flow identifiers from leaking data-adaptive routing in contrast to a fixed or random selection between training and test data. For flow-based models such as rule. No Expand remains a relatively strong variant but still NetMamba, in the packet-level task we duplicate each packet to trails the full model, suggesting that top-ranked seed tokens form a pseudo-flow of length five, matching the original input benefit from nearby context. Uniform WPool also degrades format. Following NetMamba’s preprocessing, we also clear performance, indicating that the coarse branch is more useful IP address and port fields to weaken explicit flow identifiers. when it preserves residual context through anti-importance For the flow-level task, we retain only flows with at least five weighted pooling rather than uniform compression. These packets and use the first five packets as input, consistent with results suggest that informative scoring, deterministic fixed-k the original flow encoder. seed routing, local neighborhood construction, and structured During splitting, we first construct training and test sets at coarse retention jointly contribute to the final model. the flow level while balancing the distribution of long flows 3) CrossGate: The third group evaluates whether explicit across subsets as much as possible. The test set preserves interaction between the two branches is useful. Removing the class distribution induced by the flow-level split, whereas CrossGate causes moderate performance drops on both datasets. the training and validation sets are balanced through underMacro-F1 decreases by 1.56 percentage points on CSTNET- sampling to reduce the influence of majority classes during

Fig. 7. Few-shot performance curves under different labeled data ratios.

Fig. 8. Empirical CDF of batch throughput in the DPDK–GPU pipeline. Dashed lines indicate mean batch throughput.

training. We also construct the token-level and global auxiliary features required by NetCoFi for packet samples. Table VI shows that NetCoFi outperforms NetMamba on both TLS-120 tasks under per-flow splits. The Macro-F1 gains are 3.3 points for packet-level classification and 4.6 points for flow-level classification. These results show that the gains persist when test flows are unseen during training. G. Few-shot Evaluation Figure 7 examines label efficiency by plotting F1 against the fraction of labeled training data on CTU-13, USTCTFC2016, and ISCXVPN2016. The main question is whether the proposed coarse-fine dual-branch routing remains effective when supervision is scarce, unlike only in the fully supervised regime. The curves show that NetCoFi remains competitive or strongest across labeled-data ratios, especially on CTU-13. NetCoFi remains near the top across all three datasets and all labeled-data ratios, with particularly consistent gains in low-data settings. H. DPDK–GPU Deployment We test NetCoFi in a traffic processing pipeline with DPDK packet capture and a Python/GPU backend. A flow

assembler groups packets using a canonical bidirectional fivetuple. Packets from both directions share one flow state, while direction is retained as a side feature. For each flow, the assembler records packet bytes, length, direction, TCP flags, and inter-arrival time. Once five packets are available, it constructs the same fixed-length input used in the main experiments. Flow windows are then batched for GPU inference without waiting for the session to end. NetCoFi and NetMamba share the same DPDK frontend, flow assembler, feature processing, batching policy, and hardware. We measure batch throughput from DPDK-delivered packets to model predictions. This includes flow aggregation, feature construction, routing where applicable, and GPU inference. Disk I/O and offline trace loading are excluded. Figure 8 shows the batch throughput distribution, and it demonstrates that NetCoFi improves throughput consistently across the batch distribution, as evidenced by the rightward shift of the CDF curve. Mean batch throughput rises from 26.42 Mb/s to 43.42 Mb/s, making it 1.64 times that of NetMamba. V. C ONCLUSION Encrypted traffic classification requires efficient inference under limited inference resources, together with reliable discrimination under limited payload visibility. We presented NetCoFi, a coarse-fine dual-branch Mamba architecture that learns token importance to route informative stride tokens to a fine branch while pooling complementary context into a coarse branch. By introducing an explicit routing budget, which is resolved into stable seed, neighborhood, and coarse-token routing variables, and adopting a sandwich-style multi-budget training strategy with endpoint and random-intermediate budget sampling, NetCoFi supports more stable budget-conditioned inference within the trained budget interval and outperforms NetMamba across multiple public benchmarks. R EFERENCES [1] S. Rezaei and X. Liu, “Deep learning for encrypted traffic classification: An overview,” IEEE Communications Magazine, 2019.

[2] M. Shen, K. Ye, X. Liu, L. Zhu, J. Kang, S. Yu, Q. Li, and K. Xu, “Machine learning-powered encrypted network traffic analysis: A comprehensive survey,” IEEE Communications Surveys & Tutorials, vol. 25, no. 1, pp. 791–824, 2023. [3] C. Yang, Z. Gu, Y. Wei, G. Xiong, G. Gou, S. Yao, and Y. Yu, “Unidirectional encrypted traffic classification: A survey,” in Asia-Pacific Conference on Image Processing, Electronics and Computers (IPEC), 2024. [4] N. Wickramasinghe, A. Shaghaghi, G. Tsudik, and S. K. Jha, “SoK: Decoding the Enigma of Encrypted Network Traffic Classifiers,” in 2025 IEEE Symposium on Security and Privacy (SP), 2025, pp. 1825–1843. [5] C. Liu, L. He, G. Xiong, Z. Cao, and Z. Li, “Fs-net: A flow sequence network for encrypted traffic classification,” in IEEE INFOCOM 2019 IEEE Conference on Computer Communications, 2019, pp. 1171–1179. [Online]. Available: https://doi.org/10.1109/INFOCOM.2019.8737507 [6] X. Lin, G. Xiong, G. Gou, Z. Li, J. Shi, and J. Yu, “Et-bert: A contextualized datagram representation with pre-training transformers for encrypted traffic classification,” in Proceedings of the ACM Web Conference 2022, 2022, pp. 633–642. [Online]. Available: https://doi.org/10.1145/3485447.3512217 [7] R. Zhao, M. Zhan, X. Deng, Y. Wang, Y. Wang, G. Gui, and Z. Xue, “Yet another traffic classifier: A masked autoencoder based traffic transformer with multi-level flow representation,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 4, 2023, pp. 5420–5427. [Online]. Available: https://doi.org/10.1609/aaai.v37i4.25674 [8] Z. Hang, Y. Lu, Y. Wang, and Y. Xie, “Flow-mae: Leveraging masked autoencoder for accurate, efficient and robust malicious traffic classification,” in Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses, 2023, pp. 297–314. [Online]. Available: https://doi.org/10.1145/3607199.3607206 [9] T. Wang, X. Xie, W. Wang, C. Wang, Y. Zhao, and Y. Cui, “Netmamba: Efficient network traffic classification via pre-training unidirectional mamba,” in 2024 IEEE 32nd International Conference on Network Protocols (ICNP), 2024, pp. 1–11. [Online]. Available: https://doi.org/10.1109/ICNP61940.2024.10858569 [10] Z. Song, Z. Ma, Q. Yu, X. Xie, Y. Wang, and G. Yang, “PaT: An enhanced pretrained framework via mamba-2 for network traffic analysis,” Computer Networks, vol. 283, p. 112307, 2026. [Online]. Available: https://doi.org/10.1016/j.comnet.2026.112307 [11] A. Gu and T. Dao, “Mamba: Linear-time sequence modeling with selective state spaces,” 2023. [Online]. Available: https: //arxiv.org/abs/2312.00752 [12] T. Dao and A. Gu, “Transformers are ssms: Generalized models and efficient algorithms through structured state space duality,” 2024. [Online]. Available: https://arxiv.org/abs/2405.21060 [13] V. F. Taylor, R. Spolaor, M. Conti, and I. Martinovic, “Robust smartphone app identification via encrypted network traffic analysis,” IEEE Transactions on Information Forensics and Security, vol. 13, no. 1, pp. 63–78, 2017. [14] T. Van Ede, R. Bortolameotti, A. Continella, J. Ren, D. J. Dubois, M. Lindorfer, D. Choffnes, M. Van Steen, and A. Peter, “Flowprint: Semi-supervised mobile-app fingerprinting on encrypted network traffic,” in Network and Distributed System Security Symposium (NDSS), 2020. [15] M. Lotfollahi, M. Jafari Siavoshani, R. Shirali Hossein Zade, and M. Saberian, “Deep packet: A novel approach for encrypted traffic classification using deep learning,” Soft Computing, vol. 24, no. 3, pp. 1999–2012, 2020. [Online]. Available: https://doi.org/10.1007/ s00500-019-04030-2 [16] H. Zhang, L. Yu, X. Xiao, Q. Li, F. Mercaldo, X. Luo, and Q. Liu, “Tfe-gnn: A temporal fusion encoder using graph neural networks for fine-grained encrypted traffic classification,” in Proceedings of the ACM Web Conference 2023, 2023, pp. 2066–2075. [Online]. Available: https://doi.org/10.1145/3543507.3583227 [17] H. Y. He, Z. G. Yang, and X. N. Chen, “Pert: Payload encoding representation from transformer for encrypted traffic classification,” in 2020 ITU Kaleidoscope: Industry-Driven Digital Transformation (ITU K), 2020, pp. 1–8. [18] X. Yan, “Deep learning-based efficient analysis for encrypted traffic,” Applied Sciences, vol. 13, no. 21, p. 11776, 2023. [19] Z. Chen, X. Wei, and Y. Wang, “Encrypted traffic classification encoder based on lightweight graph representation,” Scientific Reports, 2025. [20] M. S. Ryoo, A. Piergiovanni, A. Arnab, M. Dehghani, and A. Angelova, “Tokenlearner: What can 8 learned tokens do for images and videos?” in

Advances in Neural Information Processing Systems (NeurIPS), 2021. [Online]. Available: https://arxiv.org/abs/2106.11297 [21] Y. Rao, W. Zhao, B. Liu, J. Lu, J. Zhou, and C.-J. Hsieh, “Dynamicvit: Efficient vision transformers with dynamic token sparsification,” in Advances in Neural Information Processing Systems (NeurIPS), 2021. [Online]. Available: https://arxiv.org/abs/2106.02034 [22] Y. Liang, C. Ge, Z. Tong, Y. Song, J. Wang, and P. Xie, “Not all patches are what you need: Expediting vision transformers via token reorganizations,” in International Conference on Learning Representations (ICLR), 2022. [Online]. Available: https://arxiv.org/abs/ 2202.07800 [23] H. Yin, A. Vahdat, J. M. Alvarez, A. Mallya, J. Kautz, and P. Molchanov, “A-vit: Adaptive tokens for efficient vision transformer,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022. [Online]. Available: https://arxiv.org/abs/2112.07658 [24] D. Bolya, C.-Y. Fu, X. Dai, P. Zhang, C. Feichtenhofer, and J. Hoffman, “Token merging: Your vit but faster,” in International Conference on Learning Representations (ICLR), 2023. [Online]. Available: https://arxiv.org/abs/2210.09461 [25] D. Raposo, S. Ritter, B. Richards, T. Lillicrap, P. Conway Humphreys, and A. Santoro, “Mixture-of-depths: Dynamically allocating compute in transformer-based language models,” in Proceedings of the 41st International Conference on Machine Learning (ICML), 2024. [Online]. Available: https://arxiv.org/abs/2404.02258 [26] A. Sharma, S. Najafi, P. Farinneya, B. Jamialahmadi, M. S. Tahaei, Y. Fan, M. Rezagholizadeh, B. Chen, and A. Jafari, “Dtrnet: Dynamic token routing network to reduce quadratic costs in transformers,” 2025. [Online]. Available: https://arxiv.org/abs/2509.00925 [27] S. Teerapittayanon, B. McDanel, and H. T. Kung, “Branchynet: Fast inference via early exiting from deep neural networks,” in International Conference on Pattern Recognition (ICPR), 2016. [Online]. Available: https://arxiv.org/abs/1709.01686 [28] J. Xin, R. Tang, J. Lee, Y. Yu, and J. Lin, “Deebert: Dynamic early exiting for accelerating bert inference,” in Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics (ACL), 2020. [Online]. Available: https://arxiv.org/abs/2004.12993 [29] A. Graves, “Adaptive computation time for recurrent neural networks,” 2016. [Online]. Available: https://arxiv.org/abs/1603.08983 [30] X. Wang, F. Yu, Z.-Y. Dou, T. Darrell, and J. E. Gonzalez, “Skipnet: Learning dynamic routing in convolutional networks,” in European Conference on Computer Vision (ECCV), 2018. [Online]. Available: https://arxiv.org/abs/1711.09485 [31] W. Fedus, B. Zoph, and N. Shazeer, “Switch transformers: Scaling to trillion parameter models with simple and efficient sparsity,” 2021. [Online]. Available: https://arxiv.org/abs/2101.03961 [32] R. J. Babaria, M. Lyu, G. Batista, and V. Sivaraman, “Fastflow: Early yet robust network flow classification using the minimal number of time-series packets,” 2025. [Online]. Available: https: //arxiv.org/abs/2504.02174 [33] C. Busse-Grawitz, R. Meier, A. Dietmüller, T. Bühler, and L. Vanbever, “pforest: In-network inference with random forests,” in Proceedings of the ACM SIGCOMM Symposium on SDN Research (SOSR), 2019. [Online]. Available: https://arxiv.org/abs/1909.05680 [34] A. Hassan, “Cstnet,” IEEE Dataport, 2024. [Online]. Available: https://dx.doi.org/10.21227/4394-fv34 [35] A. Habibi Lashkari, G. Draper Gil, M. S. I. Mamun, and A. A. Ghorbani, “Characterization of tor traffic using time based features,” in Proceedings of the 3rd International Conference on Information Systems Security and Privacy - ICISSP, INSTICC. SciTePress, 2017, pp. 253–262. [36] G. D. Gil, A. H. Lashkari, M. Mamun, and A. A. Ghorbani, “Characterization of encrypted and vpn traffic using time-related features,” in Proceedings of the 2nd International Conference on Information Systems Security and Privacy (ICISSP 2016), Rome, Italy, 2016, pp. 407–414. [37] W. Wang, M. Zhu, X. Zeng, X. Ye, and Y. Sheng, “Malware traffic classification using convolutional neural network for representation learning,” in 2017 International Conference on Information Networking (ICOIN). IEEE, 2017, pp. 712–717. [38] A. Sharma and H. Babbar, “Detecting cyber threats in real-time: A supervised learning perspective on the ctu-13 dataset,” in 2024 5th International Conference for Emerging Technology (INCET), 2024, pp. 1–5.

Related documents

• NetCoFi: A Budget-Aware Coarse-Fine Dual-Branch Model for Encrypted Traffic Classification#1343176
• PERO: Efficient Robust Post-Training Foundation Models for Encrypted Traffic Classification#616666
• PERO: Efficient Robust Post-Training Foundation Models for Encrypted Traffic Classification#616166
• From Benchmark to Deployment: Shift-Robust Fabric Recognition for Industrial Textile Onboarding#1083275
• Fairness in multi-class multi-group classification problems via contextial coherent risk measures#799443