VFRDAD: An IoT Encrypted traffic identification method based on multi-scale local information and enhanced global information fusion

The pervasive adoption of encryption and the rapid expansion of Internet of Things (IoT) devices have made encrypted traffic classification a crucial aspect of network security and traffic management. Current methods that transform encrypted traffic into grayscale images for classification can extract hidden patterns and features within the traffic without the need to decrypt it. However, these methods face two main challenges: firstly, they struggle to accurately capture subtle local features within traffic images; secondly, their ability to acquire global contextual information is relatively weak. As a result, existing approaches often fail to adequately represent the complex patterns inherent in encrypted traffic, leading to suboptimal classification accuracy. To address this challenge, this paper proposes an encrypted traffic identification method based on multi-scale local information and enhanced global information fusion (VFRDAD). First, VFRDAD maps session-level traffic into grayscale images and applies multi-scale high-pass filtering to capture fine-grained local patterns at different frequency bands, integrating them through convolutional operations. Second, a traffic-domain autoencoder performs channel remapping to generate a three-channel representation, and dilated convolutions are employed to enlarge the receptive field and enhance global structural context. The resulting three-channel images are then processed by a Vision Transformer (ViT) to extract global contextual representations. Finally, a gated-attention fusion module adaptively combines local and global features for classification. Experiments on Darknet-dataset-2020, ISCXVPN2016, and CIC-IoT-2023 demonstrate that VFRDAD consistently outperforms representative baselines under the evaluated protocols and settings.