Adaptive encrypted traffic classification via online hash center evolution

With the widespread adoption of network encryption protocols, encrypted traffic enhances communication privacy while posing new challenges for threat detection. Although deep learning based encrypted traffic classification has achieved notable progress in recent years, most existing methods rely on offline training and a closed-world assumption, which limits their ability to handle previously unseen traffic in real environments. As a result, these models lack the capability to recognize and expand to novel classes in an open world setting. To address this issue, we propose an Online Hash Center Evolution (OHCE) method for dynamic encrypted traffic classification, enabling efficient identification of known classes and proactive discovery of unknown ones. OHCE consists of two stages. In the pretraining stage, we design a multi-prototype class hash learning module that enhances intra-class diversity modeling through multi-prototype representations and hash encoding, producing compact and effective low-dimensional hash features. In the adaptive online classification stage, we introduce an online hash center evolution method that employs Hamming ball neighbor search for fast discrimination between known and unknown flows. A curriculum-weighted clustering strategy is further incorporated to discover and model unknown flows through a progressive self-supervised process that learns from easy flows before difficult ones. This allows the class space to evolve continuously by updating hash centers online. Experimental results demonstrate that OHCE achieves high accuracy in both known class recognition and unknown class detection under open network environments, validating its effectiveness in dynamic encrypted traffic scenarios.