Federated Distributed Network Traffic Classification Based on Deep Mutual Learning

Abstract

As encrypted traffic analysis becomes increasingly vital for network security, the conventional reliance on centralized classification faces growing challenges due to data privacy regulations and data silos across heterogeneous nodes. Federated learning (FL) emerges as a solution by training models locally and sharing only parameter updates, thus preserving privacy. However, its performance is significantly degraded by data heterogeneity (i.e., non-IID data) among participants. To address this critical challenge, this paper proposes a Federated Learning framework based on Deep Mutual Learning (FLDML). In this method, clients first train local models on their private traffic data and then upload them to a server. There, they engage in deep mutual learning through co-training on a shared public dataset to enhance robustness and mitigate data heterogeneity. Subsequently, a global classifier is generated by averaging the model parameters. When evaluated on the ISCX VPN-NonVPN 2016 dataset, FLDML demonstrates significantly superior performance in handling non-IID traffic data compared to classical FL algorithms. This study concludes that the proposed framework not only effectively mitigates data heterogeneity in federated scenarios but also provides a scalable and improved solution for distributed network traffic classification.

1. Introduction

With the widespread use of the internet and the growing sophistication of cyberattacks [1], cybersecurity has become a critical concern for businesses and individuals alike [2,3]. Therefore, as a vital technique, network traffic classification enables the detection of threats, efficient resource allocation, and informed network planning [4]. Meanwhile, the rapid deployment of Internet of Things (IoT) devices has led to increasingly heterogeneous network traffic [5]. For instance, traffic from IoT sensors, video streaming platforms, and cloud services varies significantly in data formats, statistical distributions, and quality of service (QoS) requirements [6].

Although conventional network traffic classification methods, such as port-based approaches, deep packet inspection (DPI) [7], and traditional machine learning techniques [8], perform well in specific scenarios, they struggle with new traffic types, encrypted flows, and non-independent and identically distributed (non-IID) data. These methods rely heavily on manual feature engineering, which demands domain expertise for constructing effective representations from increasingly complex data. While deep learning demonstrates strong potential in traffic classification, its reliance on centrally collected large datasets introduces privacy concerns and increases the risk of data leakage during training [9].

In practical network environments, such as cross-organizational security operation collaborations, multi-tenant cloud infrastructures, or joint analysis between internet service providers and content providers, the traffic data held by different participants often cannot be centralized due to privacy regulations, commercial confidentiality, or administrative boundaries. Traditional centralized classification methods face compliance risks and data silos in such scenarios. Federated learning (FL) [10] provides a collaborative paradigm of “moving models, not data,” in which participants train models locally and only exchange model updates, thereby offering a feasible approach for distributed network traffic classification that balances privacy preservation with collaborative learning capabilities [11,12].

Thus, federated learning has emerged as a promising decentralized machine learning paradigm. It enables multiple participants to collaboratively train a shared model without exchanging raw data. This approach not only preserves data privacy but also addresses the challenges posed by inherently distributed data sources. Owing to these advantages, federated learning has become a pivotal tool for network traffic classification research.

A predominant challenge in conventional federated learning stems from non-independent and identically distributed (non-IID) data across clients. This means that the local datasets held by different clients exhibit distinct statistical properties [13,14]. This data heterogeneity leads local models to overfit their respective client-specific data patterns, thereby degrading their overall performance. The issue is particularly acute in network traffic classification, where the core objective is to build models capable of generalizing to the global data distribution. Overfitting to localized client patterns directly undermines this goal, leading to poor performance on unseen traffic.

To address the critical challenges of data heterogeneity (non-IID data) and privacy preservation in federated learning, this paper introduces a novel federated network traffic classification framework based on deep mutual learning, which we term the FLDML framework. The proposed FLDML framework is designed to effectively mitigate data heterogeneity, enhance inter-client collaboration, and maintain strict data privacy—all within a unified federated learning process.

The main contributions of this paper are as follows:

• Mitigating Data Heterogeneity: We introduce a deep mutual learning mechanism to mitigate the performance degradation of conventional federated learning under non-IID data. This mechanism fosters knowledge exchange among clients, enhancing model generalization across diverse distributions by preventing overfitting to localized patterns.
• The FLDML Framework: We propose the FLDML framework. Its core innovation is a server-side mutual learning phase, where client models are co-trained on a public dataset to assimilate a more robust and generalized representation, complementing their local training on private data.
• A Lightweight Local Model: We design a lightweight local model architecture that integrates a 1D-CNN with Batch Normalization (BN), termed BN-CNN. This design is tailored for efficient feature extraction from preprocessed traffic sequences. Experiments on the ISCX VPN-NonVPN 2016 dataset confirm that BN-CNN achieves superior accuracy and F1-score over traditional baselines.
• Comprehensive Validation: Through extensive comparative experiments on the ISCX dataset, we demonstrate that FLDML achieves higher traffic classification accuracy than both a centralized BN-CNN baseline and classical federated algorithms like FedAvg, effectively balancing performance with the privacy benefits of decentralized training.

The remainder of this paper is organized as follows. Section 2 reviews related work. Section 3 describes the dataset and details the proposed model. Section 4 presents and analyzes the experimental results. Finally, Section 5 concludes the paper and outlines future work.

2. Related Work

This section reviews the background and theoretical foundations of federated learning-based traffic classification, structured around three key perspectives. First, we analyze the limitations of conventional methods, which are constrained by data silos and privacy issues inherent in centralized architectures. Second, we discuss how federated learning addresses these challenges through decentralized, privacy-preserving collaboration. Third, we examine the synergistic benefits of integrating deep mutual learning with federated learning to mitigate data heterogeneity and enhance model generalization. Collectively, this review clarifies the motivation and theoretical underpinnings of our proposed approach.

2.1. Conventional Network Traffic Classification

Network traffic classification is crucial for network security and management [15,16]. Traditional methods, including port-based and payload-based techniques [17,18], have suffered from declining accuracy and escalating computational costs due to the proliferation of encrypted protocols and evolving network technologies. This has spurred a shift toward machine learning. However, conventional algorithms such as Support Vector Machines (SVMs) [19], Naive Bayes [20], and K-Nearest Neighbors (KNN) [21] are limited by their reliance on manual feature engineering and their inability to capture complex, high-dimensional patterns.

Deep learning, particularly Convolutional Neural Networks (CNNs) [22], offers automated feature extraction and superior pattern recognition. Yet, its effectiveness depends on large-scale, centralized labeled datasets, raising significant privacy and data aggregation concerns.

Federated learning (FL) [23] emerges as a solution by enabling collaborative model training across decentralized nodes without sharing raw data. This paradigm not only preserves data privacy but also alleviates the dependency on centralized data pools, directly addressing key challenges like data heterogeneity and privacy in traffic classification.

2.2. Federated Learning for Network Traffic Classification

Data heterogeneity is a critical challenge in network traffic classification. While most existing studies focus on single-technique approaches, they struggle to simultaneously ensure privacy protection and effectively model heterogeneous data distributions. Conventional centralized deep learning relies on data aggregation, which raises compliance risks due to potential privacy violations. Moreover, confining training to a single node restricts the model’s exposure to the global data distribution, ultimately leading to suboptimal classification performance. Although federated learning [23] offers a promising solution, techniques such as hierarchical clustering and weighted aggregation only partially address data heterogeneity, with inter-model collaboration mechanisms remaining underexplored.

Recent studies have applied federated learning to traffic classification [24]. For instance, Bakopoulou et al. [25] proposed a federated learning-based framework for packet classification, employing Federated Averaging (FedAvg) [26] to aggregate local models. Their experiments on three real-world datasets demonstrated superior performance in classification accuracy, communication efficiency, and computational cost. Similarly, Mun and Lee [27] developed FLIC, a privacy-preserving protocol for classifying emerging traffic types. However, the non-IID (non-Independent and Identically Distributed) distribution of traffic categories across clients causes slow convergence and limited accuracy in federated learning models [28]. To overcome these limitations, this paper introduces a novel approach aimed at enhancing the accuracy of federated traffic classification under heterogeneous (non-IID) data conditions.

2.3. Deep Mutual Learning

Both Deep Mutual Learning (DML) [29] and Knowledge Distillation (KD) [30] represent two prominent paradigms for model enhancement through knowledge transfer, moving beyond conventional single-model training. By facilitating interactions between models, they can achieve objectives such as model compression, improved generalization, and adaptation to heterogeneous data [31]. However, their underlying architectures and operational mechanisms diverge significantly.

KD is characterized by an asymmetric teacher–student framework. A pre-trained, high-performance teacher model unidirectionally transfers knowledge (e.g., via softened outputs or intermediate representations) to guide the training of a typically smaller student model. This paradigm is highly effective for model compression and cross-modal transfer tasks. In contrast, DML operates on a peer-to-peer basis, where multiple student models of similar capacity are trained collaboratively and synchronously. They engage in bidirectional knowledge exchange, learning from each other’s outputs throughout the training process. This symmetrical cooperation makes DML particularly suitable for mitigating data heterogeneity [32], as it fosters a consensus among models without imposing a hierarchical structure.

Notably, DML’s peer-to-peer architecture offers distinct advantages in federated learning scenarios. Specifically, in federated learning with non-IID data, a single teacher model in KD may become biased toward the data distribution of certain clients, thus failing to fairly represent the heterogeneous knowledge across all participants. In contrast, the peer-to-peer mutual learning paradigm enables all client models to collaboratively negotiate and distill a consensus representation through bidirectional knowledge exchange. In federated traffic classification, after initial local training on private data, client models can further refine their knowledge through mutual learning on a shared public dataset. This process allows each model to preserve local data characteristics while assimilating global patterns. Critically, it avoids the limitation inherent in KD where a single, potentially biased teacher model may not adequately represent all clients’ heterogeneous data. Consequently, DML demonstrates greater adaptability and robustness in dynamic, non-IID federated environments compared to the unidirectional knowledge flow of KD.

Capitalizing on this synergy, this paper innovatively integrates DML into the federated learning framework and proposes the FLDML method. FLDML is designed to enhance local model generalization through structured bidirectional interactions. By enabling models to learn collaboratively from public data, it directly compensates for the distributional discrepancies present in their private datasets, thereby addressing the core challenge of data heterogeneity in federated traffic classification.

3. Materials and Methods

3.1. Overview

Deep learning has advanced end-to-end network traffic classification by reducing both human intervention and false alarm rates [33]. However, increasingly stringent privacy regulations limit data availability for centralized model training. While federated learning (FL) presents a compelling privacy-preserving alternative, its efficacy is severely undermined by performance degradation under non-IID data distributions. This creates a core dilemma: how to simultaneously guarantee strict privacy, maintain model efficiency, and achieve robust generalization in federated traffic classification.

To address the performance degradation caused by non-IID data in federated learning, this paper introduces a novel framework that integrates deep mutual learning, termed the Federated Deep Mutual Learning (FLDML) method. As illustrated in Figure 1, the FLDML framework preserves data privacy by design, requiring no exchange of raw client data. The process comprises three sequential stages: (1) Local Training: Each client trains a local model (student) on its preprocessed private traffic flows. (2) Server-side Mutual Learning: Clients upload their local models to a central server, where they undergo a deep mutual learning process by co-training on a shared public dataset. This bidirectional knowledge exchange enhances model robustness and mitigates data heterogeneity. (3) Model Aggregation: The server performs weighted averaging on the mutually refined models to produce an updated global model.

3.2. Datasets

Addressing the critical challenge of data preprocessing in heterogeneous federated network traffic classification, our experiments are conducted on the ISCX VPN-NonVPN 2016 encrypted dataset [34], which contains 28 GB of real-world traffic collected by the University of New Brunswick’s Cybersecurity Laboratory using Tcpdump V4.9 and Wireshark V2.2. As shown in

Table 1. ISCX VPN and Non-VPN traffic service types.

Traffic Service Type	Application	File Size
Chat	AIM, ICQ, Skype, Facebook, Hangouts	29.5MB
VPN Chat		27.6 MB
Email	Email, Gmail	13 MB
VPN Email		7.8 MB
File Transfer	Skype, SFTP, FTPS, SCP	17.3 GB
VPN File Transfer		279 MB
Streaming	Vimeo, Youtube, Netflix, Spotify	1.53 GB
VPN Streaming		1.37 GB
Torrent	uTorrent, Bittorrent	96.8 MB
VPN Torrent		358 MB
VoIP	Facebook, Skype, Hangouts, VoIPbuster	4.48 GB
VPN VoIP		360 MB

, the dataset contains 12 distinct service types (6 conventional and 6 VPN-encrypted), is stored in standard pcap/pcapng formats, and possesses an inherently imbalanced distribution. To accommodate encrypted video/audio streams and ensure privacy compliance, we implement comprehensive preprocessing including data segmentation, cleansing, restructuring, and partitioning.

3.3. Client-Side Data Preprocessing

The client-side preprocessing pipeline comprises four distinct stages to transform raw traffic data into standardized session-level inputs. (1) Traffic Splitting: Session-level flows are extracted from pcap/pcapng files through quintuple-based packet aggregation (source/destination IP, ports, protocol) using SplitCap V1.9. (2) Data Cleaning: Flows undergo purification by removing duplicates and anomalies, followed by full anonymization through MAC/IP address zeroing. (3) Feature Restructuring: Each session is encoded into a normalized 784 × 1 vector through ASCII conversion, min-max scaling to [0, 1], and length standardization via truncation/zero-padding as shown in Figure 2. (4) Dataset Partitioning: Processed sequences are organized into training/testing splits stored in NPZ format. This pipeline enables each client K to generate private training streams $D_{pr}={\left\{(x_i,y_i)\right\}}_{i=1}^N$ with $x_i\in {\mathbb{R}}^{784}$ and $y_k\in \{1,2,\dots ,M\}$.

3.4. Client-Side Local Model Training

At the t-th communication round, the server randomly selects $a\ge 2$ clients to form set A using $max(C·K,2)$, where $C\in (0,1]$ controls participant fraction. Each client $k\in A$ downloads the global model $\theta$ and parameters $w_t^k$ from the server to initialize its local model ${\theta }_k$ with parameters ${\omega }_t^k$.

As illustrated in Figure 3, each client employs a BN-CNN classifier for local training. Preprocessed traffic data (Section 3.3)—converted to session-level $n\times d$ sequences normalized to [0, 1]—is fed into the model. The architecture comprises stacked Conv1D, Batch Normalization (BN), and MaxPooling layers, enabling efficient extraction of temporal features from traffic flows while accelerating convergence and reducing initialization sensitivity. The output layer utilizes Softmax to generate classification probabilities, with the highest value indicating the predicted traffic class.

The BN-CNN design (Figure 4,

Table 2. Network structure and parameter setting of BN-CNN model.

Layer	Operation	Input Size	Filter Size	Stride	Output Size
1	Conv1d + BN	784 × 1	4 × 1	2	391 × 32
2	MaxPool	391 × 32	3 × 1	3	130 × 32
3	Conv1d + BN	130 × 32	3 × 1	2	64 × 64
4	MaxPool	64 × 64	3 × 1	3	21 × 64
5	Linear	21 × 64	-	-	256
6	Linear	256	-	-	12
7	Softmax	12	-	-	12

) incorporates two Conv1D layers (kernel sizes 41 and 31), two BN layers, ReLU activations, MaxPooling (window size 3), and two fully connected layers. This configuration leverages 1D convolution’s translation invariance to recognize shifted temporal patterns, multi-scale kernels for hierarchical feature extraction, and BN for regularization—effectively stabilizing gradients, mitigating overfitting, and enhancing test-set generalization [35,36].

The BN-CNN model structure and parameter settings are as shown in Table 2. Client k iteratively trains the local model ${\theta }_k$ using the private stream $D_{pr}^k$ for E epochs to obtain an updated student model ${\theta }_k$ and model parameters $w_t^k$. The probability of class m for sample $x_i$ given by the student model ${\theta }_k$ is calculated as $p_k$, which can be expressed by Formula (1).

$$p_k^m\left(x_i\right)={\displaystyle \frac{exp\left(z_1^m\right)}{{\sum }_{m=1}^{M}exp\left(z_1^m\right)}}$$

(1)

Here, $z^m$ is the logistic output of the model ${\theta }_k$. For a multi-class classification task on network traffic, the objective function for training the local model ${\theta }_k$ is defined as the cross-entropy error between the predicted values and the correct labels. The cross-entropy loss $L_k^{local}$ can be expressed by Formula (2).

$$L_k^{local}=-\sum _{i=1}^N\sum _{m=1}^{M}I\left(y_i,m\right)log\left(p_k^m\left(x_i\right)\right)$$

(2)

Here, the function $I(·)$ can be defined by Formula (3).

$$I\left(y_i,m\right)=\left\{\begin{array}{cc}1& y_i=m\\ 0& y_i\ne m\end{array}\right.$$

(3)

3.5. Server-Side Student Models Learn from Each Other and Model Average Aggregation Stages

Each client k uploads the student model ${\theta }_k$ and its model parameters ${\omega }_t^k$ to the server. On the server, the student model ${\theta }_k$ undergoes mutual learning using a small public dataset $D_{cm}={\left\{x_i,y_i\right\}}_{i=1}^N$, where $y_iϵ\left\{1,2,\dots ,M\right\}$. Then, after iterative training for F rounds, we obtain the updated model ${\theta }_k^{DML}$ and model parameters ${\omega }_t^{DM{L}_k}$. The cross-entropy loss $L_k^{DML}$ of the student model ${\theta }_k$ on the public dataset $D_{cm}$ can be expressed by Formula (4).

$$L_k^{DML}=-\sum _{i=1}^N\sum _{m=1}^{M}I\left(y_i,m\right)log\left(p_k^m\left(x_i\right)\right)$$

(4)

Additionally, another student model ${\theta }_2$ and its posterior probability $p_2$ are used to provide training experience for ${\theta }_1$. To quantify the difference between the predictions $p_1$ and $p_2$ of the two student models, the Kullback–Leibler $KL$ divergence is used to measure the distance between the distributions $p_1$ and $p_2$, which is expressed in Formula (5).

$$D_{KL\left(p_2\Vert p_1\right)}=\sum _{i=1}^n\sum _{m=1}^M{p}_2^m\left(x_i\right)log{\displaystyle \frac{p_2^m\left(x_i\right)}{p_1^m\left(x_i\right)}}$$

(5)

Through deep mutual learning, each heterogeneous student network learns to correctly predict the true labels of the public data stream (supervised loss $L_k^{DML}$), as well as to match the probability estimates of its peer ($KL$ divergence loss), thereby improving the performance of the student models.

The overall loss functions for models ${\theta }_1$ and ${\theta }_2$ at communication round t are $L_{{\omega }_1}$ and $L_{{\omega }_2}$ respectively, which are expressed in Formulas (6) and (7).

$$L_{{\omega }_1}=\alpha L_1^{Local}+\beta L_1^{DML}+\gamma D_{KL}\left(p_2\Vert p_1\right)$$

(6)

$$L_{{\omega }_2}=\alpha L_2^{Local}+\beta L_2^{DML}+\gamma D_{KL}\left(p_1\Vert p_2\right)$$

(7)

Here, $\alpha$, $\beta$, and $\gamma$ are hyperparameters that control the proportion of knowledge coming from the data or from other models. Therefore, for client k’s model ${\theta }_k$ during the t-th communication process, the overall loss function $L_{\omega k}$ can be expressed by Formula (8).

$$L_{\omega k}=\alpha L_k^{local}+\beta L_k^{DML}+\gamma D_{KL}\left(p_{avg}\Vert p_k\right)$$

(8)

Here, $p_{avg}={\displaystyle \frac{1}{\left|A\right|-1}}{\sum }_{j=1,j\ne k}^{\left|A\right|}{p}_j$

Finally, the model parameters ${\omega }_t^{DM{L}_k}$ from multiple models are averaged to obtain the local model parameters ${\omega }_{t+1}$ at the end of the t-th communication round, which can be expressed by Formula (9).

$${\omega }_{t+1}\leftarrow {\displaystyle \frac{1}{\left|A\right|}}\sum _{kϵA}{\omega }_t^{DM{L}_k}$$

(9)

Repeat the steps described for the t-th communication round until the local model parameters $\omega$ converge, at which point the network traffic classification task based on the FLDML method is completed.

3.6. The FLDML Algorithm

Algorithm 1 will detail the three learning phases of the proposed FLDML algorithm. Steps 1–3 of the data preprocessing phase (Section 3.3): Each client $k\in K$ obtains their local private training stream $D_{pr}^k={\left\{x_i,y_i\right\}}_{i=1}^N$, where $y_i\in \left\{1,2,\dots ,M\right\}$, through four steps: data partitioning, data cleaning, data restructuring, and data splitting.

Algorithm 1 FLDML Algorithm

Require:         K, Number of clients of the network operator;         B, Small batch size;         E, Client model training rounds;         F, Students model rounds of learning from each other;         $\eta$, Learning rate;         $D_{p}r$,$D_{c}m$, Private stream, public stream         Data preprocessing: $Preproccess(K,D)$         for each client k = 1, 2, …, K do            $D_{pr}^k\leftarrow Preproccess\left(k,D\right)$         end for         Server-side training: $ServerTrain\left(\omega ,K\right)$         for each epoch t = 1, 2, …, T do            $m\leftarrow max\left(C·K,2\right)$            $A\leftarrow \left(randomsetofmclients\right)$            for each client $k\in A$ in paralled do              ${\omega }_t\leftarrow \omega$              ${\omega }_t^k\leftarrow LocalUpdate\left({\omega }_t,D_{pr}^k\right)$            end for            for each client $j\in A$, $j\ne k$ do              for each epoch $f=1,2,\dots ,F$ do                 ${\omega }_t^{DM{L}_k}\leftarrow DMLUpdate\left({\omega }_t^j,{\omega }_t^k,D_{cm}\right)$              end for            end for            $Merge:{\omega }_{t+1}\leftarrow {\displaystyle \frac{1}{\left|A\right|}}{\sum }_{k\in A}{\omega }_t^{DM{L}_k}$         end for         Client local training: $LocalUpdate\left(\omega ,D_{pr}^k\right)$         $ϵ\leftarrow \left(split{D}_{pr}^k;intobatchesofsizeB\right)$         for each local epoch from 1 to E do            for each $b\in ϵ$ do              $\omega \leftarrow \omega -\eta L^{local}\left(\omega ;b\right)$            end for         end for         return $\omega \to server$

Steps 1–14 of the server training phase: During the t th communication round, the server first transmits the local model parameters $\omega$ to a randomly selected set of clients A for local model training (LocalUpdate). Then, the server receives the student models from the clients and uses them for mutual learning (DMLUpdate) on the public stream $D_{cm}={\left\{x_i,y_i\right\}}_{i=1}^N$. The total loss for a client $k\in A$ can be represented by Formula (8). Finally, an average aggregation is used to compute the local model parameters ${\omega }_{t+1}$, where the local model is the BN-CNN model described in Section 3.4.

Steps 1–7 of the client local training phase, corresponding to Step 6 of the server training phase: Within a single epoch, the local model is trained on batches of size b samples and iteratively trained E times to obtain updated student model parameters $\omega$. These model parameters are then uploaded to the server. The supervised loss function for the local model is defined in Formula (2).

4. Experimental Results and Discussion

4.1. Experimental Settings

Federated Averaging (FedAvg) is the most classic and widely used aggregation algorithm in federated learning, renowned for its simplicity and efficiency. Consequently, it serves as a standard baseline for comparison across FL studies. To validate the performance improvement of FLDML under non-IID data conditions, we select FedAvg as the primary baseline, using identical communication and training settings.

We evaluated our approach in the ISCX VPN-NonVPN 2016 dataset following the preprocessing methodology described in Section 3.3. After preprocessing, the dataset contains approximately 1.5 million session samples covering 12 classes (6 conventional and 6 VPN-encrypted traffic types), which exhibit a significantly imbalanced class distribution as shown in Figure 5. The resulting sample distribution after preprocessing is further illustrated in Figure 5. Figure 6 demonstrates the partition ratio between the public dataset and the private datasets across clients in the FLDML framework.

For standalone BN-CNN classification, we employed a 6:1 train-test split with a batch size of 128, cross-entropy loss [37], and an SGD optimizer [38] at a learning rate of 0.01.

For the FLDML framework, we extended this configuration with client–server data partitioning (7:1 private-to-public ratio, Figure 6) using batch size 28. We set the number of clients to 10 ($K=10$) to simulate distributed participants with heterogeneous network traffic characteristics (e.g., different service types, temporal patterns, and traffic volumes), such as different enterprises, branch offices, or user groups. The BN-CNN architecture (Table 2) served as the local model across 10 clients ($K=10$), with participant fraction $C=0.2$. Training executed for $E=5$ local and $F=5$ federated rounds, optimized by SGD (lr = 0.01) with combined cross-entropy and KL-divergence objectives.

4.2. Experimental Evaluation

To comprehensively assess classification performance under class imbalance, we employ accuracy, precision, recall, and F1-score as evaluation metrics. These metrics are derived from the confusion matrix (

Table 3. Confusion matrix.

	Predicted Value (Positive)	Predicted Value (Negative)
True Value (Positive)	TP (True Positives)	FN (False Negatives)
True Value (Negative)	FP (False Positives)	TN (True Negatives)

) and formally defined as follows:

$$Accuracy={\displaystyle \frac{TP+TN}{TP+TN+FP+FN}}$$

(10)

$$Precision={\displaystyle \frac{TP}{TP+FP}}$$

(11)

$$Recall={\displaystyle \frac{TP}{TP+FN}}$$

(12)

$$F1-score={\displaystyle \frac{2\times Precision\times Recall}{Precision+Recall}}$$

(13)

All metrics range between [0, 1], with higher values indicating better performance. Accuracy measures overall correctness, precision reflects positive prediction fidelity, recall quantifies positive class coverage, and F1-score represents their harmonic mean.

4.3. Experimental Results and Analysis

4.3.1. Evaluation of the Local Model

We evaluated the BN-CNN model on the ISCX VPN-NonVPN 2016 encrypted traffic dataset through comprehensive comparisons with C4.5, KNN, 1D-CNN, and CNN-LSTM baselines. The validation focused on two key aspects: BN layer efficacy and comparative performance.

BN Layer Impact. Our ablation study compared BN-CNN against an architecturally identical CNN-without-BN. Figure 7 demonstrates BN-CNN’s accelerated convergence and marginally superior final accuracy. Quantitative results (

Table 4. Classificationperformance of CNN-without-BN vs. BN-CNN.

Model	Accuracy	Precision	Recall	F1-Score
CNN-without-BN	0.951	0.953	0.952	0.951
BN-CNN	0.958	0.960	0.957	0.959

) confirm consistent improvements: +0.7% accuracy, +0.7% precision, +0.5% recall, and +0.8% F1-score, validating BN’s role in enhancing temporal feature extraction and model stability.

Comparative Performance. Against the 1D-CNN baseline [39] under identical input configurations (session-level 784 × 1 sequences), BN-CNN achieved notable gains (Figure 8): Email (17%) and VoIP (5.1%) precision improvements; Chat (18%) and VoIP (12.2%) recall enhancements; and superior F1-scores for Chat (+11.2%) and Email (+11%). Extended benchmarking (

Table 5. Comparison experimental results of BN-CNN with other methods.

Model	Accuracy	Precision	Recall	F1-Score
C4.5	0.807	0.810	0.808	0.807
KNN	0.735	0.746	0.737	0.738
DP-CNN	0.941	0.944	0.937	0.940
CNN-LSTM	0.920	0.922	0.920	0.921
BN-CNN	0.958	0.960	0.957	0.959

) shows BN-CNN outperforming machine learning (C4.5, KNN) and deep learning alternatives (DP-CNN, CNN-LSTM), with particular advantages over DP-CNN (+1.7% accuracy) and CNN-LSTM (+3.8% accuracy). These results substantiate our preprocessing pipeline’s efficacy for temporal traffic characterization.

4.3.2. Evaluation of FLDML

We evaluate the proposed FLDML approach under both IID and non-IID federated learning scenarios to validate its effectiveness in network traffic classification.

IID Scenario. Under IID settings, private data samples were randomly and uniformly distributed across 10 clients (Figure 9). Comparative experiments against centralized training and FedAvg demonstrate FLDML’s competitive performance. As shown in Figure 10, FLDML achieves faster convergence during early training stages and comparable final accuracy to the centralized approach while outperforming FedAvg. Quantitative results (

Table 6. Comparison of classification performance across different methods.

Method	Accuracy	Precision	Recall	F1
Centralized	0.958	0.960	0.957	0.959
FedAvg	0.944	0.942	0.948	0.944
FLDML	0.948	0.946	0.952	0.949

) confirm FLDML’s marginal performance gap versus centralized training (−1% accuracy, −1.4% precision) while surpassing FedAvg across all metrics (+0.4–0.5%). This demonstrates FLDML’s ability to maintain model performance while providing enhanced data privacy.

Non-IID Scenario. We construct four non-IID scenarios through sorted partitioning, creating data distributions with m = 2, 5, 8, 10 label classes per client (Figure 11). FLDML consistently outperforms FedAvg across all heterogeneity settings (

Table 7. Comparison of classification performance across different methods under various non-IID scenarios.

Heterogeneity Level Configuration	Algorithm	Evaluation Index
		Precision	Recall	F1
m = 2	FedAvg	0.867	0.864	0.865
	FLDML	0.886	0.887	0.887
m = 5	FedAvg	0.918	0.921	0.920
	FLDML	0.942	0.944	0.942
m = 8	FedAvg	0.936	0.939	0.938
	FLDML	0.940	0.944	0.942
m = 10	FedAvg	0.939	0.936	0.939
	FLDML	0.943	0.945	0.943

), with particularly notable gains under extreme heterogeneity (m = 2: +1.9% precision, +2.3% recall). Convergence analysis (Figure 12) reveals FLDML’s stable superiority in final accuracy across all non-IID configurations. The integration of deep mutual learning enables knowledge transfer through soft labels, effectively regulating student model outputs and enhancing aggregation effectiveness in heterogeneous environments.

The mutual learning phase on the public dataset serves as an effective regularizer, compelling each client model to distill and align generalized feature representations that transcend their locally skewed data distributions. This process not only mitigates overfitting to client-specific patterns but also enhances the semantic consistency across models, thereby improving the stability and generalization capability of the aggregated global model, especially under high heterogeneity.

5. Conclusions

This paper proposes FLDML, a federated learning method incorporating deep mutual learning to address non-IID data challenges in network traffic classification. Experimental results in the ISCX VPN-NonVPN 2016 datasets demonstrate its superiority over conventional federated approaches.

Future work will focus on the following promising directions: (1) enhancing the framework’s robustness under more realistic and dynamic federated conditions, including client drop-out, network latency, and adversarial presence; (2) investigating adaptive or meta-learning strategies to automatically tune the hyperparameters that balance the local, mutual, and consensus loss components; and (3) extending FLDML to semi-supervised or unsupervised federated learning scenarios, aimed at handling unknown or emerging traffic types without fully labeled data.