DualEvo: Open-Set Mobile Traffic Identification via Signature-Gated Contextual Verification

Accurate identification of mobile traffic is fundamental to network management and security. However, the explosive growth and frequent evolution of mobile applications present a formidable open-set challenge, rendering conventional models trained in a closed-world setting prone to performance degradation. While signature-based methods are often perceived as more adaptable to real-world network environments, the design of their matching patterns relies excessively on manual expertise, and they exhibit insufficient accuracy for identifying encrypted traffic. Conversely, machine learning (ML) approaches uncover latent features but are notoriously sensitive to training data and typically fail in open-set scenarios by misclassifying unknown traffic. Current research predominantly refines ML frameworks, largely overlooking how principles of signature-based methods can guide ML toward robust open-set identification. To bridge this gap, we propose DualEvo, a dual-stage evolution-aware framework. First, a signature-gated filter uses automatically generated meta-feature signatures from invariant packet length segments to swiftly discard irrelevant traffic. Surviving flows then undergo contextual verification, which leverages a contextual packet length matrix and ensemble learning to confirm matches with high confidence. Experiments on 1,000 applications show DualEvo achieves a 94.46% F1 score with only 208 false positives among one million unknown traces, proving its superior accuracy and robustness in open-set environments.