Not All Flows are Worth N Packets: Robust Encrypted Traffic Classification via Dynamic Patch-level Feature Learning

Network traffic classification is significant for modern network security. The widespread use of encryption protocols, such as TLS, has resulted in fewer identifiable features of traffic, rendering encrypted traffic classification a challenging task. However, existing flow-level classification methods typically rely on the features of the first N packets. This fixed-length paradigm, truncating long flows and padding short flows with invalid data, is difficult to adapt to the dynamic distribution of traffic length, which limits robustness in interference environments such as packet loss. Considering this limitation, we propose DART, a robust encrypted traffic classification method via dynamic patch-level feature learning. We first design a robust feature representation method to improve robustness against interference, which divides a flow into multiple sub-flows named patches to extract patch-level features, replacing the interference-prone packet-by-packet sequence and significantly reducing the length of the feature sequence. We also propose a sample-adaptive dynamic inference mechanism in response to traffic heterogeneity. The input scale is adaptively selected based on traffic complexity, and simple samples are allowed to exit early in shallow layers, achieving a balance between accuracy and efficiency. The experimental results on two public malware traffic datasets demonstrate that DART exhibits excellent anti-interference robustness and improves classification accuracy by 6.59%-30.51%, while maintaining high classification efficiency compared to existing mainstream methods.