A Lightweight Network for Encrypted Traffic Classification Based on Convolutional Positional Encoding and Efficient Multi-Scale Attention

Abstract

Network traffic classification is a cornerstone of network management and security. Addressing the challenges of feature extraction in encrypted traffic and the deployment limitations of traditional deep learning models on resource-constrained edge devices due to their large parameter sizes, this paper proposes a lightweight network for encrypted traffic classification, termed CEMA-Net (Convolutional Positional Encoding and Efficient Multi-scale Attention Network). Specifically, the proposed model integrates an Efficient Multi-scale Attention (EMA) mechanism with a Convolutional Positional Encoding (CPE) strategy to jointly capture global dependencies and local contextual information. To enable efficient adaptation to traffic data, an Efficient Multi-scale Attention Adapter (EMAAdapter) is designed, which reconstructs one-dimensional traffic sequences into a pseudo-2D representation and extracts horizontal, vertical, and local features in parallel. This design facilitates effective modeling of complex cross-scale dependencies in encrypted traffic with minimal computational overhead. Experimental results on three public datasets demonstrate that the proposed method, with only 0.66 M parameters, achieves superior classification performance compared with mainstream vision-based models such as ResNet-101, while significantly reducing computational cost. These results highlight the effectiveness of combining convolutional positional encoding with multi-scale attention mechanisms and provide an efficient solution for encrypted traffic classification in resource-constrained environments.

1. Introduction

Traffic classification forms the bedrock of network administration and security, offering essential support for bandwidth allocation, quality of service (QoS) assurance, user experience optimization, and threat detection. With the rapid proliferation of emerging technologies such as 5G, the Internet of Things (IoT), edge computing, and cloud computing, network traffic has become increasingly diverse, large-scale, and dynamic. To achieve smart network administration and uphold system robustness, implementing reliable and swift traffic categorization has thus become paramount [1,2,3,4].

However, the widespread adoption of encryption protocols, including Transport Layer Security (TLS), Secure Sockets Layer (SSL), and Quick UDP Internet Connections (QUIC), has fundamentally challenged traditional traffic classification methods. Since packet payloads are no longer accessible, conventional approaches such as deep packet inspection (DPI) and port-based classification have become largely ineffective. In addition, modern network environments are highly dynamic and heterogeneous, requiring classification models with strong generalization capabilities across different scenarios. Meanwhile, real-time requirements in edge computing and IoT systems impose strict constraints on computational complexity, memory consumption, and inference latency, making it difficult for conventional deep learning models with large parameter sizes to be efficiently deployed.

Existing traffic classification methods can be broadly categorized into traditional approaches, machine learning-based methods, and deep learning-based methods. Traditional techniques rely on predefined rules or payload inspection, but they are ineffective in encrypted environments and often raise privacy concerns. Machine learning-based approaches improve flexibility by leveraging statistical features of traffic flows; however, they typically depend on handcrafted feature engineering and exhibit limited generalization in complex and evolving network scenarios. More recently, deep learning methods, including convolutional neural networks (CNNs), recurrent neural networks (RNNs), and Transformer-based architectures, have demonstrated superior performance by automatically learning high-level representations from raw traffic data. Nevertheless, these models usually involve high computational overhead and large parameter sizes, which hinder their applicability in real-time and resource-constrained environments.

To address these challenges, this paper proposes a lightweight network for encrypted traffic classification, termed CEMA-Net (Convolutional Positional Encoding and Efficient Multi-scale Attention Network), which integrates convolutional positional encoding with an efficient multi-scale attention mechanism. The proposed method is designed to effectively capture complex traffic patterns while maintaining a balance between classification accuracy and computational efficiency. By integrating multi-scale attention mechanisms with lightweight architectural design, CEMA-Net enables efficient modeling of both local and global dependencies in traffic data. Experimental results demonstrate that the proposed model achieves superior classification performance while significantly reducing computational cost compared with state-of-the-art methods.

The main contributions of this paper are as follows:

• The EMA mechanism is successfully migrated to traffic classification through the design of an Efficient Multi-scale Attention Adapter (EMAAdapter). By reconstructing 1D traffic sequences into a pseudo-2D spatial representation, the adapter captures multi-scale dependencies across both horizontal and vertical dimensions, thereby significantly enhancing feature extraction efficiency.
• A novel Convolutional Positional Encoding and Efficient Multi-scale Attention Block (CEMA Block) is designed, featuring a sandwich structure with depthwise positional encodings (CPE) at both entry and exit stages. This configuration injects local spatial inductive bias into the Transformer-like architecture, effectively compensating for the inherent limitations of pure attention in modeling fine-grained, short-term packet dependencies.
• By leveraging directional pooling and cross-dimension feature reweighting, the proposed method achieves representational capacity comparable to deep 2D CNNs (e.g., ResNet-101) while incurring only a fraction of the computational cost, making it perfectly tailored for real-time deployment within environments with resource constraints.

2. Related Work

2.1. Traditional Methodologies for Network Traffic Classification

As a vital mechanism for network administration and cybersecurity, traffic identification plays a fundamental role, aiming to identify application types, such as video streaming, web browsing, and file transfer, or protocol types, including Hyper Text Transfer Protocol (HTTP) and File Transfer Protocol (FTP), within network traffic. This process supports key functions such as bandwidth allocation, Quality of Service (QoS) assurance, network monitoring, and security protection, thereby playing a vital role in optimizing user experience and mitigating network threats [5]. Generally, three primary paradigms constitute the landscape of established traffic identification techniques: port-mapping, deep packet inspection (DPI), and classical machine learning reliant on statistical features [6,7,8]. To deduce the underlying application types, port-driven tactics inspect the destination identifiers within Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) headers. This is exemplified by mapping standard services like HTTP, HTTPS, and FTP to their respective designated ports (80, 443, and 21) in accordance with the Internet Assigned Numbers Authority (IANA) registry. Owing to their simplicity and low computational overhead, these methods were widely adopted in early network infrastructure, including routers, firewalls, and load balancers. However, the conventional mapping between port numbers and applications has been significantly weakened due to dynamic port allocation, port hopping, and Network Address Translation (NAT). This issue is further exacerbated by Peer-to-Peer (P2P) applications (e.g., BitTorrent, Skype, and Zoom) using random high ports, malicious traffic disguising command-and-control communication as HTTPS, and the widespread adoption of encrypted protocols such as HTTPS, QUIC, and Transport Layer Security version 1.3 (TLS 1.3). Consequently, the accuracy of port-based methods has declined substantially, often falling below 50% in real-world environments, making them unsuitable for modern network scenarios. DPI improves classification accuracy by inspecting packet payloads and matching protocol signatures, and has been widely used in carrier traffic management and intrusion detection. Nevertheless, DPI suffers from high computational cost, potential privacy concerns, and limited effectiveness on encrypted traffic, particularly in high-throughput 5G networks and resource-constrained edge environments [9]. In addition, early statistical methods extract features such as packet size and inter-arrival time and combine them with traditional machine learning algorithms. Although these approaches can partially handle encrypted traffic, they rely heavily on manual feature engineering, exhibit limited generalization capability, and struggle to adapt to dynamic and heterogeneous environments such as the Internet of Things (IoT) and 5G [10]. With encrypted traffic accounting for more than 80% of network traffic, increasing real-time requirements, and increasingly complex network scenarios, the limitations of conventional methods—such as inefficiency in handling high-dimensional data, inability to meet low-latency demands, and poor cross-scenario generalization—have become increasingly prominent [11].

2.2. Machine Learning Methodologies for Network Traffic Classification

To transcend the constraints inherent in traditional port-mapping and deep packet inspection (DPI) techniques, utilizing machine learning for network traffic identification has advanced swiftly since the late 20th century, emerging as a leading paradigm. These methods primarily rely on statistical feature extraction from traffic, including packet size distribution, inter-arrival time, traffic direction, and burstiness, without depending on port numbers or payload content, which makes them well suited for encrypted and dynamically changing network environments. Driven by the need to better identify specific traffic profiles like P2P and VoIP, supervised learning models (most notably decision trees and support vector machines) gained substantial traction on labeled datasets during the early 2000s, especially within intrusion detection domains [12]. With the growth of data volume and the emergence of new applications, unsupervised learning methods gained attention in the 2010s due to their ability to identify unknown traffic patterns and process large-scale data efficiently [13]. In recent years, deep learning techniques, including convolutional neural networks (CNNs) and recurrent neural networks (RNNs), have significantly improved classification accuracy by enabling automatic extraction of high-dimensional features, demonstrating strong performance in handling encrypted traffic and dynamic 5G environments [14]. Despite these advances, several challenges remain. Traditional supervised models rely heavily on high-quality labeled datasets, which are costly to construct and difficult to maintain in rapidly evolving environments such as the Internet of Things (IoT) and 5G networks [15]. Although semi-supervised learning attempts to alleviate this issue by leveraging both labeled and unlabeled data, its performance and generalization ability are still limited. Furthermore, conventional machine learning methods depend on manual feature engineering, which is labor-intensive, subjective, and prone to overfitting. In addition, their computational overhead may hinder real-time performance in resource-constrained scenarios [16]. To address these challenges, recent deep learning-based traffic classification methods adopt end-to-end feature learning and achieve notable performance improvements; however, their high computational complexity and dependence on powerful hardware still limit deployment on low-power devices.

2.3. Deep Learning Methodologies for Network Traffic Classification

To effectively manage high-dimensional, complex, and encrypted traffic data, deep-learning-based network traffic categorization has progressed rapidly, yielding outcomes that significantly exceed those of traditional machine learning methods. The autonomous extraction of hierarchical representations from raw traffic streams defines the advantage of deep learning models over traditional schemes like decision trees and support vector machines, which are bound to manual feature engineering. This automated profiling is realized through multi-layer frameworks, encompassing convolutional neural networks (CNNs), recurrent neural networks (RNNs), and Transformers. This capability reduces dependence on domain expertise and improves adaptability to dynamic network environments. As a result, deep learning achieves higher accuracy and robustness in classifying encrypted traffic, such as TLS and SSL, and in identifying complex application patterns, including real-time video streaming and P2P file sharing, particularly in high-throughput 5G and IoT scenarios. For example, Wang et al. [17] proposed an end-to-end encrypted traffic classification framework based on one-dimensional CNNs, integrating feature extraction and classification into a unified model to capture nonlinear relationships and improve efficiency. Similarly, Lotfollahi et al. [18] combined stacked autoencoders with CNNs to jointly optimize feature learning and classification, enhancing the processing of high-dimensional traffic data. Zhang et al. [19] proposed NetST, which employs a hierarchical Swin Transformer to capture both local and global spatial dependencies in traffic images. While NetST emphasizes long-range modeling, the proposed CEMA-Net focuses on structural efficiency through a multi-scale attention mechanism, aiming to balance accuracy and computational cost. Driven by their outstanding capacity for global feature modeling and long-range dependency capture, Transformer-based architectures have gained significant traction in the domain of traffic categorization recently [20]. Despite these advances, several challenges remain. Performance improvements are often achieved at the cost of increased model depth and complexity, leading to high computational and memory requirements that hinder deployment on resource-constrained devices such as IoT sensors and edge gateways. Furthermore, prevailing deep learning architectures are heavily dependent on massive labeled datasets, the compilation and maintenance of which remain labor-intensive and challenging amid volatile network dynamics [21]. To circumvent these obstacles, we introduce a parameter-efficient deep learning network built around a convolutional positional encoding and efficient multi-scale attention mechanism, successfully decreasing processing overhead and memory footprints without sacrificing classification precision or stability.

2.4. Summary and Motivation

In summary, existing traffic classification methods exhibit inherent limitations. Traditional approaches lack effectiveness in encrypted environments and fail to meet modern network requirements. Machine learning-based methods improve flexibility but rely heavily on handcrafted features and labeled data, limiting their adaptability. Deep learning methods achieve superior performance but often suffer from high computational complexity and resource consumption, making them unsuitable for real-time deployment in resource-constrained scenarios.

Therefore, developing a lightweight and efficient traffic classification model that can effectively handle encrypted traffic while maintaining high accuracy and low computational overhead remains a critical research challenge. This motivates the proposed CEMA-Net, which aims to address these issues through an efficient multi-scale attention mechanism, convolutional positional encoding, and a lightweight architectural design.

3. CEMA-Net Traffic Classification Model

This section presents CEMA-Net, a lightweight encrypted traffic classification framework based on an efficient multi-scale attention mechanism. We first provide an overview of the overall architecture, followed by detailed descriptions of its key components.

3.1. Model Architecture

The proposed model mainly consists of a data preprocessing stage and the CEMA-Net architecture. First, raw network traffic is processed and converted into grayscale images through a series of preprocessing operations. These images are then fed into CEMA-Net, where they are transformed into one-dimensional sequence features via two stages of convolution, flattening, and linear projection. Specifically, the input grayscale traffic image with a resolution of $40\times 40$ first passes through two convolutional embedding stages. In the first stage, a $3\times 3$ convolutional layer with a stride of 2 and padding of 1 is employed to extract shallow spatial features, generating feature maps of size $(C/4)\times 20\times 20$, where $C$ denotes the target embedding dimension. Subsequently, a second $3\times 3$ convolutional layer with a stride of 2 and padding of 1 further increases the channel dimension while compressing the spatial resolution, producing feature maps of size $C\times 10\times 10$.

The resulting feature map is then flattened along the spatial dimensions to transition from a 2D spatial representation to a 1D sequence representation:

$$C\times 10\times 10\to C\times 100$$

(1)

Finally, a linear projection layer is applied to compress the sequence length from 100 to 40. After a permutation operation to align the dimensions, the final sequence representation is achieved as:

$$X_{seq}\in {\mathbb{R}}^{40\times C}$$

(2)

which is subsequently fed into the stacked CEMA blocks for hierarchical feature extraction.

Subsequently, six blocks are employed for feature extraction and fusion, incorporating convolutional positional encoding (CPE), layer normalization, depthwise convolution, and an efficient multi-scale attention mechanism. Residual connections, together with the attention mechanism, enable effective modeling of both local and global features, thereby enhancing representation capability while maintaining low computational complexity. Finally, global average pooling along with a classification head (comprising normalization and a linear layer) is applied to yield the definitive categorization outputs, as depicted in the macro framework of Figure 1.

3.2. Data Preprocessing

In this study, the data preprocessing procedure follows the methodology described in [22], where raw network traffic stored in PCAP format is transformed into image-based representations. This transformation enables the model to effectively capture both structural and statistical characteristics of encrypted traffic.

First, network traffic is segmented into flows based on the standard five-tuple, including source IP address, destination IP address, source port, destination port, and protocol type. Redundant and irrelevant information, such as duplicate packets, empty packets, and link-layer metadata (e.g., MAC addresses), is removed to reduce noise and improve data quality.

For each flow, fixed-length byte segments are extracted from packet headers and payloads. The initial bytes of packets within a flow are concatenated to form a unified one-dimensional byte sequence, defined as:

$$X=[b1,b2,\dots ,bn]$$

(3)

where $bi$ denotes the $i$-th byte in the sequence and $n$ represents the total number of bytes. This representation integrates information at the byte, packet, and flow levels, thereby preserving semantic continuity and capturing fine-grained traffic patterns. As defined in Equation (3), the constructed sequence provides a unified representation of traffic flows. Compared with conventional segmentation strategies, this approach reduces information loss and mitigates bias caused by arbitrary partitioning.

Next, the byte sequence is transformed into a two-dimensional grayscale image with a fixed resolution of 40 × 40. To eliminate scale variations caused by different packet lengths, min-max normalization is applied to each byte value as follows:

$$p\prime ={\displaystyle \frac{p-p_{min}}{p_{max}-p_{min}}}$$

(4)

where $p$ is the original byte value, and $p_{min}$ and $p_{max}$ denote the minimum and maximum values within the sequence, respectively. As given in Equation (4), this normalization maps the data into a uniform range, improving numerical stability and facilitating faster model convergence.

Finally, the normalized sequence is reshaped into a grayscale image matrix $I\in {\mathbb{R}}^{40\times 40}$, where each element represents a pixel intensity value. The resulting image preserves the structural relationships within the traffic data and serves as the input to the subsequent feature extraction network. An illustration of the preprocessing pipeline is shown in Figure 2.

3.3. CEMA Block

The backbone network consists of multiple stacked CEMA Blocks, each following an identical computational structure. Given an input sequence $X$, each block begins by injecting local positional information using a depthwise convolution with residual connection, as shown in Equation (5):

$$X_1=X+DWConv(X)$$

(5)

This operation introduces local spatial inductive bias while preserving the original feature information.

Subsequently, layer normalization is applied to stabilize feature distributions as shown in Equation (6):

$$\tilde{X}=LayerNorm\left(X_1\right)$$

(6)

The normalized features are then projected into two parallel branches through linear transformations as shown in Equation (7):

$$X_f=W_f\tilde{X},X_g=\sigma \left(W_g\tilde{X}\right)$$

(7)

where $X_f$ represents the transformed features and $X_g$ serves as a gating signal.

The main branch further enhances local context through depthwise convolution and nonlinear activation as shown in Equation (8):

$$X_l=\varphi \left(DWConv\left(X_f\right)\right)$$

(8)

where $\varphi \left(·\right)$ denotes the SiLU activation function.

The resulting features are then processed by the EMAAdapter module to capture long-range dependencies as shown in Equation (9):

$$X_a=\mathcal{A}\left(X_l\right)$$

(9)

where $\mathcal{A}\left(·\right)$ denotes the EMA-based attention operation.

The output of the EMAAdapter is modulated by the gating branch through element-wise multiplication and projected back to the original feature space as shown in Equation (10):

$$X_{attn}=W_o\left(X_a\odot X_g\right)$$

(10)

This gated interaction enables adaptive feature selection and enhances representation quality.

The attention output is then integrated with the residual connection using stochastic depth regularization as shown in Equation (11):

$$X_2=X_1+DropPath\left(X_{attn}\right)$$

(11)

To further reinforce local inductive bias and enhance spatial feature interaction, a second depthwise convolution-based positional encoding is applied as shown in Equation (12):

$$X_3=X_2+DWConv\left(X_2\right)$$

(12)

Finally, a feed-forward network is employed for channel-wise feature transformation as shown in Equation (13):

$$X_{out}=X_3+D\left(MLP\left(LayerNorm\left(X_3\right)\right)\right)$$

(13)

where $D\left(\cdot \right)$ denotes stochastic depth regularization.

Through the stacking of multiple such blocks, the model alternates between local feature aggregation and global dependency modeling, enabling effective interaction between spatial context and long-range semantic information. This hierarchical design enables the model to learn discriminative representations from flattened image inputs, which are subsequently utilized by the classification head, as illustrated in Figure 3.

EMAAdapter Module

The EMAAdapter module serves as a core component of the proposed CEMA-Net, designed to efficiently model long-range dependencies in sequence representations. Unlike conventional self-attention mechanisms that rely on explicit query-key-value (QKV) computations, this module adopts a lightweight design based on sequence-to-pseudo-2D reshaping and multi-scale spatial feature aggregation, significantly reducing computational complexity.

Given an input feature sequence $X_l\in {\mathbb{R}}^{B\times L\times C}$, the module first applies a Sequence-to-Pseudo-2D transformation, as shown in Equation (14):

$$X_{2D}=Reshape\left({Conv}_{1\times 1}\left(X_l\right)\right)$$

(14)

Specifically, to bridge the dimensionality gap between the 1D sequence and the 2D multi-scale attention module, the EMAAdapter module maps the 1D sequence features $X_{seq}\in {\mathbb{R}}^{40\times C}$ into a pseudo-2D space. The height (h) and width (w) dimensions are derived by treating the sequence length as a single spatial dimension while introducing a dummy dimension, resulting in a pseudo-2D tensor of size $C\times 40\times 1$. Here, the pseudo-height is defined as $h=40$ and the pseudo-width is $w=1$. This formulation enables the subsequent 2D strip convolutions and parallel sub-networks within the EMA module to perform spatial feature encoding along the sequence axis without altering the intrinsic token length.

It then processes the pseudo-2D feature map through three parallel branches to capture multi-scale spatial information. Specifically, horizontal pooling is applied along the width dimension to obtain $X_h$ as shown in Equation (15), vertical pooling is performed along the height dimension to obtain $X_v$ as shown in Equation (16), and a local 3 × 3 convolution is conducted to extract local features $X_l$ as shown in Equation (17):

$$X_h=AdaptiveAvgPool\left(X_{2D}, along width\right)$$

(15)

$$X_v=AdaptiveAvgPool\left(X_{2D}, along height\right)$$

(16)

$$X_l={Conv}_{3\times 3}\left(X_{2D}\right)$$

(17)

These multi-scale features are subsequently aggregated and refined using softmax-based feature reweighting, as shown in Equation (18):

$$X_{agg}=Softmax\left(f\left(X_h,X_v,X_l\right)\right)\odot X_{2D}$$

(18)

where $f\left(·\right)$ denotes the fusion function that combines the outputs of the three branches (typically via concatenation followed by a lightweight projection). Subsequently, cross-dimension interaction is performed in the pseudo-2D space, as shown in Equation (19):

$$X_{refined}=g\left(X_{agg}\right)\in {\mathbb{R}}^{H\times W\times D\prime }$$

(19)

Finally, the refined features are converted back to sequence form through the Pseudo-2D-to-Sequence operation, as shown in Equation (20):

$$X_{out}=Reshape\left(X_{refined}\right)\in {\mathbb{R}}^{B\times L\times C\prime }$$

(20)

This design enables the simultaneous modeling of horizontal, vertical, and local dependencies while preserving spatial structure awareness in flattened image sequences. Compared with standard self-attention, the Multi-Scale Spatial Attention avoids explicit pairwise similarity computation, thereby mitigating the quadratic complexity $O\left(L^2\right)$ with respect to sequence length L. The combination of pseudo-2D reshaping, multi-directional pooling, local convolution, and cross-dimension interaction allows efficient multi-scale modeling of both global and local dependencies.

Moreover, the module is seamlessly integrated within the CEMA Block, where it operates in conjunction with convolutional positional encoding (CPE) and the feed-forward network (MLP). While the Multi-Scale Spatial Attention captures global contextual relationships across different directions and scales, CPE injects fine-grained positional information, enabling the model to better understand spatial structures in flattened image sequences. This synergistic design significantly enhances the expressive capability of the network while maintaining computational efficiency.

In addition, the modular design allows flexible adaptation to different sequence lengths and feature dimensions by adjusting the channel expansion ratio and convolutional kernel configurations. This makes the proposed method particularly suitable for large-scale and resource-constrained image-based sequence classification tasks, as illustrated in Figure 4.

3.4. Convolutional Positional Encoding

CPE is introduced to enhance spatial positional information in sequence data, addressing the inherent limitation of attention mechanisms in modeling local dependencies. Specifically, local context awareness is incorporated through depthwise separable convolutions at both the input stage (denoted as CPE1) and the output stage (denoted as CPE2) of each backbone module. This design empowers the model to seamlessly resolve dependencies among neighboring elements within the sequence.

Both CPE1 and CPE2 are implemented using one-dimensional depthwise separable convolutions with a kernel size of 3, padding of 1, and the number of groups equal to the channel dimension $d$. The kernel size of 3, together with padding = 1, ensures that the sequence length remains unchanged after convolution. Meanwhile, setting groups = $d$ enables channel-wise independent convolution, thereby preserving channel independence while significantly reducing computational complexity compared to standard convolution.

To incorporate positional information without disrupting the original feature distribution, a residual connection is adopted. As defined in Equation (21), the CPE operation is expressed as:

$$y=x+f(x)$$

(21)

where $x$ denotes the input feature sequence, $f(x)$ represents the positional encoding function implemented via depthwise convolution, and $y$ is the enhanced feature representation. This residual design facilitates the effective integration of local positional information while preserving the original features. In addition, it improves gradient propagation, thereby alleviating the vanishing gradient problem and ensuring stable training in deeper architectures.

Compared with traditional positional encoding methods, such as sinusoidal positional encoding in Transformers and Rotary Positional Embedding (RoPE), CPE offers several advantages. Instead of relying on fixed mathematical formulations, CPE employs learnable convolutional kernels to adaptively capture positional information. This allows the model to better accommodate diverse sequence characteristics across different tasks, particularly in image-based sequence classification scenarios where spatial relationships are complex and highly variable.

Furthermore, the use of depthwise separable convolution significantly reduces computational overhead, enabling CPE to enhance model performance without compromising efficiency. In addition, CPE operates synergistically with other components in the backbone network. Specifically, the EMAAdapter captures global and multi-scale dependencies, the multi-layer perceptron (MLP) enhances feature representation through nonlinear transformations, and CPE provides fine-grained local positional information. Collectively, these constituent elements establish a synergetic infrastructure, empowering the network with a dual-perspective capability to extract fine-grained and long-range structural features from sequential information.

3.5. Multi-Layer Perceptron

Following the attention branch in each CEMA Block, a feed-forward network (FFN), also referred to as the MLP sublayer in the standard Transformer architecture, is employed to perform position-wise nonlinear transformations on the feature representations. The FFN consists of two fully connected layers. The first layer expands the feature dimension from $d_{model}$ to $r\cdot d_{model}$, where $r$ denotes the expansion ratio (i.e., mlp_ratio), followed by a nonlinear activation function. The second layer then projects the features back to the original dimension $d_{model}$.

Specifically, the Gaussian Error Linear Unit (GELU) is adopted as the activation function. As defined in Equation (22), the GELU function is expressed as:

$$GELU(x)=0.5x(1+tanh(\sqrt{{\displaystyle \frac{2}{\pi }}}(x+0.044715x^3))$$

(22)

where $x$ denotes the input feature. Compared with traditional activation functions such as ReLU, GELU provides smoother nonlinear transitions and has been shown to improve performance in deep neural architectures.

The overall FFN transformation in Equation (23) is defined as:

$$FFN(X)={FC}_2(Dropout(GELU({FC}_1(Dropout(x)))))$$

(23)

where ${FC}_1(\cdot )$ and ${FC}_2(\cdot )$ denote the first and second fully connected layers, respectively, and $Dropout(\cdot )$ represents the dropout operation used for regularization.

For clarity, the FFN can also be written in a parameterized form. As shown in Equation (24), the MLP formulation is:

$$MLP(x)=W_2\cdot GELU(W_{1}x+b_1)+b_2$$

(24)

where $W_1$ and $W_2$ are learnable weight matrices, $b_1$ and $b_2$ are bias terms, and $x$ is the input feature vector.

To reinforce architectural convergence during training, a residual shortcut augmented by DropPath regularizes the interaction between the FFN output and its corresponding input. As defined in Equation (25), this process is expressed as:

$$y=x+DropPath(FFN(x))$$

(25)

where $x$ and $y$ denote the input and output of the FFN module, respectively. This residual design facilitates gradient propagation, improves training stability, and alleviates overfitting through stochastic depth regularization.

Overall, the FFN module maintains a lightweight structure while providing strong nonlinear modeling capability. It complements the efficient multi-scale attention mechanism by enhancing feature transformation at each position, thereby facilitating the effective acquisition of profound semantic insights from within encrypted traffic streams.

4. Experiments

4.1. Experimental Setup

A unified computing platform anchored all experimental runs to guarantee environmental consistency, consisting of an NVIDIA GeForce RTX 3090 GPU (NVIDIA Corporation, Santa Clara, CA, USA) and an AMD^® Epyc 7302 16-core processor (with 64 threads/cores) (Advanced Micro Devices, Inc., Santa Clara, CA, USA), managed under the Ubuntu 22.04.5 LTS operating system (Canonical Group Limited, London, UK).

4.1.1. Datasets

Three publicly accessible benchmarks—specifically Cross Platform, USTC-TFC2016, and ISCX-VPN—serve as the evaluation foundations for our experimental validations. The datasets were partitioned into training, validation, and test subsets using stratified sampling to preserve class distribution consistency across different subsets. To ensure fair comparison and experimental consistency, we adopted the same dataset partition settings as those used in Reference [22], which enables direct and reliable performance comparison with existing studies under identical experimental conditions. To reduce the risk of data leakage, all flows originating from the same capture/session were assigned to the same subset, and no correlated flows from the same capture/session were shared between training, validation, and test sets. Specifically, the Cross Platform dataset comprises user-generated traffic from 215 Android and 196 iOS applications. While the USTC-TFC2016 profile incorporates a blend of normal and anomalous network traffic, the ISCX-VPN repository encompasses both standard and encrypted VPN sessions spanning seven separate categories.

Table 1. Dataset information.

Task	Dataset	Class	Train Set	Validation Set	Test Set
Task1	Cross Platform-Android	181	44,700	4655	4656
	Cross Platform-iOS	124	40,379	4203	4205
Task2	USTC-TFC2016	20	37,323	6692	6662
Task3	ISCXVPN2016	7	13,281	1383	1384

details the comprehensive statistical breakdowns of these datasets.

4.1.2. Evaluation Metrics and Experimental Parameter Settings

Evaluation Metrics: This paper employs precision, recall, F1 score, and accuracy as evaluation criteria. The calculation formulas are as follows:

$$Precision={\displaystyle \frac{TP}{TP+FP}}$$

(26)

$$Recall={\displaystyle \frac{TP}{TP+FN}}$$

(27)

$$F1=2\times {\displaystyle \frac{Precision\times Recall}{Precision+Recall}}$$

(28)

$$Accuracy={\displaystyle \frac{TP+TN}{TP+TN+FP+FN}}$$

(29)

The evaluation metrics are established upon four fundamental classification outcomes: $TP$ and $TN$ denote the counts of true positives and true negatives that the model correctly identifies, whereas $FP$ and $FN$ quantify the erroneous assignments—specifically, actual negative instances falsely labeled as positive, and actual positive instances missed as negative, respectively.

Experimental Parameter Settings: The network optimization incorporates a 100 epoch training cycle configured with a batch size of 64. We employ the AdamW optimizer under an initial learning rate of 0.001, bounded by a weight decay factor of 1 × 10⁻⁴ and regulated via a Cosine Annealing learning rate scheduler. For the objective function, a cross-entropy loss augmented with 0.1 label smoothing is selected. Our implementation relies on the PyTorch 2.1.0 framework, with execution handled by a single NVIDIA GeForce RTX 3090 GPU system.

Table 2. Experimental parameter setting.

Parameter	Setting
Batch size	64
Epoch	100
Learning Rate Scheduler	Cosine Annealing Learning Rate
Optimizer	AdamW

outlines the consolidated parameter configurations.

4.2. Comparative Experiments

4.2.1. Evaluation Against Current Encrypted Traffic Categorization Baselines

To validate the efficacy of the proposed model, we benchmark it against prominent frameworks within the encrypted traffic domain, namely FlowPrint [20], TFE-GNN [23], ET-BERT [24], and YaTC [25]. Empirical evaluations are performed across multiple standard benchmarks, such as USTC-TFC2016, ISCXVPN2016, ISCXTor2016, and CICIoT2022. Consistent with the evaluation protocol in [22], the quantitative outcomes reveal that our method substantially outperforms current baseline solutions in terms of core evaluation criteria, including accuracy (AC) and F1-score (F1), as shown in

Table 3. Comparative Analysis of Baseline Models Under Different Data Environments.

Method	USTC-TFC2016		ISCXVPN2016		Cross Platform-Android		Cross Platform-iOS
	AC (%)	F1 (%)	AC (%)	F1 (%)	AC (%)	F1 (%)	AC (%)	F1 (%)
FlowPrint [20]	79.92	79.92	96.66	96.81	87.39	87.00	87.12	86.03
TFE-GNN [23]	97.47	97.34	84.28	84.47	81.41	80.67	82.41	81.30
ET-BERT [24]	99.10	99.10	95.66	95.65	93.86	94.01	94.01	94.01
YaTC [25]	99.47	97.34	98.19	98.19	90.42	90.42	90.42	90.42
CEMA-Net	99.94	99.53	98.19	97.48	97.40	97.20	97.47	96.88

.

Specifically, on the USTC-TFC2016 dataset, CEMA-Net delivers a 99.94% accuracy coupled with a 99.53% F1 score. Compared with the second-best model, YaTC (99.47% accuracy and 97.36% F1 score), it shows a clear advantage, with a 2.17% improvement in F1 score. On the ISCXVPN2016 dataset, CEMA-Net achieves a mean accuracy of 98.19% and an F1 score of 97.48%. Although its F1 score is slightly lower than YaTC (98.19%), CEMA-Net requires only 0.66 M parameters, significantly fewer than YaTC’s 2.3 M, indicating a better trade-off between performance and efficiency. On the Cross Platform-Android dataset, CEMA-Net achieves an accuracy of 97.40% and an F1 score of 97.20%, outperforming other methods and demonstrating strong robustness in complex environments. Similarly, on the Cross Platform-iOS dataset, it achieves an accuracy of 97.47% and an F1 score of 96.88%, surpassing ET-BERT (94.01% for both), highlighting its effectiveness in encrypted traffic classification across heterogeneous platforms. Overall, these results show that CEMA-Net consistently achieves competitive or superior performance while maintaining high efficiency.

4.2.2. Evaluation Against Conventional Traffic Classification Baselines

Demonstrating the competency of the proposed scheme in managing encrypted traffic classification workloads, our empirical trials cross-examine performance against standard multi-layer baselines, specifically ResNet101, MobileNetV2, and CNN + LSTM. Unbiased reliability is guaranteed by subjecting all candidates to uniform data configurations, preprocessing environments, and measurement parameters. Across four public benchmarks, the system’s execution is quantified via four core indices: accuracy, precision, recall, and F1 score. The statistical tracking in

Table 4. Results of datasets Cross Platform-Android and Cross Platform-iOS.

Method	Cross Platform-Android				Cross Platform-iOS
	AC (%)	PR (%)	RC (%)	F1 (%)	AC (%)	PR (%)	RC (%)	F1 (%)
ResNet101	97.14	97.16	97.06	96.92	97.54	97.01	97.15	97.02
MobileNetV2	88.31	90.27	88.46	88.92	93.10	93.47	92.74	92.95
CNN + LSTM	81.78	88.51	81.41	83.80	90.24	91.67	89.76	90.16
CEMA-Net	97.40	97.26	97.30	97.20	97.47	96.80	97.19	96.88

and

Table 5. Results of datasets ISCXVPN2016 and USTC-TFC2016.

Method	ISCXVPN2016				USTC-TFC2016
	AC (%)	PR (%)	RC (%)	F1 (%)	AC (%)	PR (%)	RC (%)	F1 (%)
ResNet101	98.04	97.43	96.57	96.98	99.92	99.38	99.29	99.33
MobileNetV2	97.03	96.90	95.92	96.38	99.92	99.11	99.11	99.11
CNN + LSTM	97.32	96.86	95.63	96.20	99.86	99.14	99.11	99.12
CEMA-Net	98.19	97.70	97.27	97.48	99.94	99.62	99.48	99.53

verifies that the engineered CEMA-Net secures steadily equivalent or superior capabilities compared across the diverse testbeds.

Empirically, CEMA-Net demonstrates a clear edge over all baseline models. When evaluated on the Cross Platform-Android and Cross Platform-iOS benchmarks, it registers an accuracy of 97.40% (with 97.26% precision and 97.30% recall) and 97.47%, alongside corresponding F1 scores of 97.20% and 96.88%, verifying a resilient cross-platform generalizability. A similar trend is observed on the ISCXVPN2016 dataset, where our framework yields a 98.19% accuracy and a 97.48% F1 score, outperforming ResNet101, which logs 98.04% and 96.98%, respectively. Most notably, under the more stringent USTC-TFC2016 environment, CEMA-Net secures peak metrics with an accuracy and F1 score reaching 99.94% and 99.53%. These quantitative outcomes confirm that the proposed network retains stable and robust classification capabilities under heterogeneous data scenarios, effectively parsing high-dimensional, intricate encrypted traffic.

4.2.3. Ablation Studies

To assess the capability of CEMA-Net alongside its stripped-down variants (specifically No-EMA, No-MLP, and No-CPE), this study evaluates their execution over four benchmark environments: ISCXVPN2016, USTC-TFC2016, and the Cross Platform paradigms for both Android and iOS. Ablation experiments evaluate the contribution of each component to overall performance. The baseline model achieves accuracies and F1 scores of 97.40%/97.20%, 97.47%/96.88%, 98.19%/97.48%, and 99.94%/99.53%, respectively, demonstrating strong classification capability. When the efficient multi-scale attention mechanism is removed (No-EMA), performance decreases to 97.16%/96.88%, 95.69%/95.18%, 97.39%/96.29%, and 99.86%/99.91%, indicating its importance for stability and effectiveness. Removing the MLP module (No-MLP) leads to more significant degradation, with results dropping to 95.51%/95.34%, 93.98%/93.40%, 97.61%/96.45%, and 99.87%/99.42%, highlighting its role in feature transformation. For the No-CPE variant, the model achieves 96.56%/96.21%, 95.52%/95.08%, 97.47%/96.57%, and 99.87%/99.10%, suggesting that CPE improves generalization and robustness. Overall, these results demonstrate that each component contributes to performance, as shown in Figure 5.

4.2.4. Training Convergence Analysis

To further evaluate the convergence behavior and training stability of the proposed model, the training and validation loss and accuracy curves on two representative datasets are illustrated in Figure 6 and Figure 7.

As shown in Figure 6, the loss curves on the Cross Platform-Android dataset exhibit a smooth convergence trend, while the accuracy increases steadily throughout the training process, with convergence achieved at approximately the 85th epoch. This behavior indicates stable optimization and reliable learning dynamics of the proposed model.

As shown in Figure 7, similar trends are observed on the ISCXVPN2016 dataset. Loss decreases smoothly, and accuracy improves, reaching convergence at the 90th epoch. Compared with the Cross Platform dataset, convergence is slightly more stable, indicating good adaptability across data distributions. Overall, the results show that CEMA-Net achieves stable convergence, high accuracy, and strong generalization across datasets.

4.2.5. Model Performance Analysis

With regard to model complexity, measured by the number of parameters, this study compares different methods on the ISCXVPN2016 dataset, as shown in

Table 6. Comparison Params, Accuracy, FLOPs of different models.

Method	Params (M)	Accuracy (%)	FLOPs (GMac)
ResNet101	47.25	98.04	0.281
MobileNetV2	2.23	97.03	0.083
CNN + LSTM	1.96	97.32	0.034
CEMA-Net	0.66	98.19	0.037

. To ensure a fair and reproducible comparison, the FLOPs for all evaluated models were computed using a standardized input tensor size of $1\times 40\times 40$, corresponding to the grayscale traffic image used in all experiments. After the embedding stage, the feature representation is projected into a sequence of size [1, 40, 96], where 40 denotes the traffic sequence length and 96 represents the embedding dimension. ResNet101 contains 47.25 million parameters and achieves an accuracy of 98.04%, but incurs a relatively high computational cost of 0.281 GMac FLOPs. MobileNetV2 reduces the number of parameters to 2.23 million and FLOPs to 0.083 GMac, achieving an accuracy of 97.03%. The CNN + LSTM hybrid further reduces the parameters to 1.96 million, with the lowest computational cost of 0.034 GMac FLOPs and an accuracy of 97.32%. In contrast, the proposed CEMA-Net demonstrates strong parameter efficiency, with only 0.66 million parameters, significantly fewer than the other models, while achieving an accuracy of 98.19%, surpassing ResNet101. In addition, it maintains a relatively low computational cost of 0.037 GMac FLOPs. These results indicate that CEMA-Net achieves a favorable balance between accuracy and computational efficiency, making it suitable for resource-constrained environments.

5. Discussion

This study proposes a lightweight classification model, CEMA-Net, and evaluates its effectiveness across multiple datasets. The results indicate that the model achieves a favorable balance between complexity and classification performance by integrating an efficient multi-scale attention module with a convolutional augmentation design into the Transformer architecture. Compared with conventional models, CEMA-Net significantly reduces the number of parameters while maintaining high accuracy, demonstrating its suitability for resource-constrained environments.

From a performance perspective, CEMA-Net achieves competitive or superior results across cross-platform and public datasets. In particular, on the Cross Platform-Android and Cross Platform-iOS datasets, the model attains F1 scores of 97.20% and 96.88%, respectively, while using substantially fewer parameters than ResNet101. Similar trends are observed on the ISCXVPN2016 and USTC-TFC2016 datasets, where the model achieves F1 scores of 97.48% and 99.53%, respectively. These results suggest that the proposed architecture generalizes well across different traffic scenarios and data distributions.

The effectiveness of CEMA-Net can be attributed to the complementary roles of its core components. The EMA mechanism enhances the ability to capture multi-scale spatial dependencies, while convolutional positional encoding and depthwise separable convolutions improve local feature extraction. This combination enables the model to effectively learn both global and local patterns in encrypted traffic data.

6. Conclusions

In conclusion, this paper presents CEMA-Net, a lightweight model that achieves strong classification performance with significantly reduced computational complexity. The model contains only 0.66 M parameters, corresponding to 1.4%, 29.6%, and 33.7% of ResNet101, MobileNetV2, and CNN + LSTM, respectively, while maintaining competitive accuracy across multiple datasets. These results demonstrate the effectiveness of the proposed design in balancing efficiency and performance.

Future work will focus on incorporating richer temporal characteristics of encrypted traffic, optimizing ultra-lightweight architectures for resource-constrained devices, and improving robustness against traffic obfuscation. These directions aim to further enhance the applicability of the model in real-world network environments.