PACC: Protocol-Aware Cross-Layer Compression for Compact Network Traffic Representation

arXiv:2602.08331 · cs.NI, cs.LG · Submitted 2026-02-09 · Read on arXiv

Listen

Radio episode about this paper

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Today's paper: "PACC: Protocol-Aware Cross-Layer Compression for Compact Network Traffic Representation".

Jane: The gist The proposed PACC framework is a redundancy-aware,

Tom: First, who's behind it and why it matters.

Title and authors: Tom: We talked about what PACC is trying to do, which is essentially using a protocol-aware approach to compress network traffic data into these compact representations. Now let's look at the authors and what their title actually signals.

Jane: The paper is by Zhaochen Guo from the University of Electronic Science and Technology of China, Tianyufei Zhou from Hong Kong, and Honghao Wang from Renmin University of China. It’s a team with strong backgrounds in both hardware systems and deep learning models.

Lu: Their background seems perfect for this kind of work because they’re coming from different angles—system design, model architecture—which is exactly what you need when you are trying to build something that respects the actual protocol hierarchy.

Meng: I wonder how their specific expertise translates into the implementation details, especially with the way they structure these representations into shared and private parts. That sounds like a delicate balance to strike in practice.

Lalam: It really suggests a vision where we can distill very dense, meaningful information from raw bitstreams without losing the context of where that data came from in the network stack.

The paper's summary: Tom: Okay, so to summarize what they’re proposing with PACC, they are addressing the problem that current methods flatten the protocol stack and lose valuable information because they don't account for redundancy both across layers and within each layer.

Jane: They propose a framework that treats the protocol stack as a set of multiview inputs and aims to learn compact layer-wise projections by explicitly factorizing these representations into shared cross-layer components and private, layer-specific components.

Lu: The core idea is that real traffic has this substantial redundancy, which shows up as cross-layer consensus—that’s the shared evidence—and there’s also unique information specific to each layer. They seek representations that capture both of those things simultaneously.

Meng: So instead of just using one monolithic embedding for the whole packet, they want a structure where we can see what's common across layers and what's unique to a specific layer, which makes sense for building layered defenses or analyses.

Lalam: It’s about separating the universal traffic patterns from the stuff that is unique to an application or a specific transport protocol. That separation should lead to much more robust classification than just using a single embedding.

The paper's improvements: Tom: The paper highlights three main things they are trying to improve: first, respecting the protocol hierarchy rather than flattening it; second, explicitly modeling the redundancy by separating shared versus unique information; and third, achieving efficiency without hurting accuracy when compressing those high-dimensional raw encodings.

Jane: They want representations that capture cross-layer consensus through mutual information learning and layer-specific evidence using another type of mutual information term. This dual objective is what drives the whole methodology.

Lu: The way they do it involves a few steps: mapping each layer to a low-dimensional latent vector, maximizing the mutual information between the raw input and that latent vector, which is done by minimizing a similarity-based reconstruction loss.

Meng: Then they enforce that shared structure by using a contrastive consensus loss to align those representations across different layers, which is clever because it forces them to agree on the common signal.

Lalam: And finally, they maximize the total task-relevant information, which is what directly relates back to minimizing the standard cross-entropy loss for classification, ensuring the final output is actually useful for whatever we’re trying to detect.

Conclusion: Tom: So wrapping up this discussion on PACC: they’ve shown that this protocol-aware approach can substantially improve practical accuracy and robustness when dealing with encrypted traffic classification compared to traditional feature engineering or raw-bit baselines.

Jane: The paper suggests that by learning these representations, we get a better understanding of which parts of the network structure carry the most reliable information for a specific task.

Lu: It’s interesting because they found that shared evidence tends to concentrate among the Network, Transport, and Application layers—about zero point three five to zero point three eight—and it actually moves the Link layer away from being so entangled with higher layers than it was before.

Meng: For practical deployment, this means we might be able to use much smaller embeddings for inference because the representation is so much more compact while still maintaining high performance on encrypted traffic classification tasks.

Lalam: It’s a big step toward having representations that are not just compressed, but also discriminative and interpretable at the layer level, which is really helpful for debugging why a model makes a certain decision.

Tom: That’s all we have time for today on PACC: Protocol-Aware Cross-Layer Compression for Compact Network Traffic Representation. We’ll be back next time to talk about how these ideas fit into the broader landscape of network security and traffic analysis.

University of Electronic Science and Technology of China · University of Hong Kong · Renmin University of China · Hong Kong Polytechnic University

cs.NI, cs.LG

Submitted: 2026-02-09

Updated: 2026-10-11

License: http://creativecommons.org/licenses/by-nc-nd/4.0/

Importance score: 92/100

The gist: The gist The proposed PACC framework is a redundancy-aware, layer-aware representation framework that learns compact latents by explicitly factorizing representations into shared (cross-layer) and

Key concepts

Layer-awareness
This principle ensures the framework respects the inherent hierarchy of network protocols rather than treating all layers as a flat list. It allows the model to understand that some features are specific to certain layers, which is crucial for effective representation learning.
Redundancy control
PACC explicitly models information as shared (cross-layer consensus) or private (layer-specific). By separating these components, the framework reduces redundant signals across different network layers, making the learned representations more efficient and focused on unique evidence.
Cross-layer consensus
This refers to the shared information present between different network layers. PACC uses this concept to align representations across layers, ensuring that common signals are captured robustly, which strengthens the overall classification evidence derived from multiple views.

Terminology

Summary

The gist The proposed PACC framework is a redundancy-aware, layer-aware representation framework that learns compact latents by explicitly factorizing representations into shared (cross-layer) and private (layer-specific) components to improve classification accuracy while enhancing efficiency.

Motivation and Problem

Network traffic classification is challenged by pervasive encryption and evolving protocols, leading to bottlenecks in representation where hand-crafted statistics are lossy, raw bits are costly, and pre-trained embeddings flatten the protocol stack. The core insight addressed is that real traffic contains substantial redundancy both across network layers and within each layer. This redundancy manifests as cross-layer consensus, which provides robust evidence for classification, and layer-specific information that must be retained. The paper formalizes this by treating the protocol stack as multiview inputs and learning compact layer-wise projections.

Design Principles

PACC is guided by three design principles: (P1) Layer-awareness, which respects the protocol hierarchy instead of flattening it; (P2) Redundancy control, which explicitly models shared vs. unique information to reduce duplicated signals across layers; and (P3) Efficiency without sacrificing accuracy, aiming to compress high-dimensional raw encodings into compact latents suitable for scalable training and low-latency inference. The framework seeks representations that capture both crosslayer consensus I(Xi; Xj) and layer-specific, task-relevant evidence such as I(Xi; Y Xj).

Methodology and Optimization

The PACC framework involves a joint objective that preserves layer-specific information via reconstruction, captures shared structure via contrastive mutual-information learning, and maximizes task-relevant information via supervised losses.

  1. Layer-wise Projection: Each layer is mapped to a low-dimensional latent Zi = fΘi(Xi) by maximizing the mutual information I(Xi; Zi). This is operationalized by minimizing a similarity-based reconstruction loss Lrec which is equivalent to maximizing the variational lower bound of the mutual information I(Xi; Zi).

  2. Shared Information Maximization: The framework posits that Zi consists of a shared component Zs i and a private component Zu i, such that I(Zi;Zj) = I(Zs i; Zs j). This alignment is enforced using a contrastive consensus loss Lcon which maximizes the differentiable InfoNCE lower bound Ilb (Zi;Zj).

  3. Task-Relevant Information Pursuit: The model maximizes the total task-relevant information I(Zi;Y), which is mathematically equivalent to minimizing the standard cross-entropy loss Lce. This objective implicitly enforces two decompositions: inter-layer decomposition I(Zi;Y) = I(Zi;Y Zi-i) + I(Zi; Zi-i;Y) and intra-layer decomposition I(Zi;Y) = I(Zu i;Y) + I(Zs i;Y Zu i).

  4. Uncertainty-Aware Fusion: A dynamic importance estimation assigns a weight wi to each layer based on intrinsic feature salience s proj i and predictive reliability s unc i. The fused representation is constructed by concatenating the weighted embeddings Zfused = [wiZ,..., wMZ]. On encrypted subsets, it achieves up to a 12.9% accuracy improvement over nPrint; and matches or surpasses strong foundation-model baselines while improving end-to-end efficiency by up to 3.16×. The analysis shows that PACC reshapes the consensus pattern, where shared evidence becomes more concentrated among Network/Transport/Application (up to ≈ 0.35–0.38), while the Link layer becomes less entangled with higher layers and all layers undergo a dramatic shift from the high-redundancy, low-relevance region toward the ideal high-information, low-redundancy zone.

Conclusion and Future Work

PACC introduces a redundancy-aware cross-layer representation framework that distills compact, discriminative embeddings from noisy raw bitstreams. By jointly optimizing layer-wise reconstruction, cross-layer consensus alignment, and task-relevant information, PACC distills compact, discriminative embeddings from noisy raw bitstreams. A natural next step is to extend the framework to session- and multi-flow settings by modeling temporal dependencies and cross-flow interactions. Another important direction is to harden PACC against adversarial and privacy-sensitive environments <ref:2602.

Improvements for AI systems

  1. Bold header: Protocol-Aware Feature Distillation for Encrypted Traffic Classification

By learning compact layer-wise projections that remain faithful to each layer while explicitly factorizing representations into shared (cross-layer) and private (layer-specific) components, the improved system can achieve classification accuracy up to 12.9% improvement over nPrint on encrypted subsets.

  1. Bold header: Robust Cross-Layer Consensus Modeling

The system can model the latent space to reflect this compositional structure, positing that Zi contains a distinct component, Zi, for this shared information which ensures that the final representation captures cross-layer consensus, providing a robust anchor against layer-specific noise.

  1. Bold header: Dual Utility Information Extraction

The improved system can simultaneously extract both shared information across layers as valuable signal reinforcement and layer-specific information that provides unique, complementary evidence, as formalized by the objective maximizing the sum of inter-layer decomposition and intra-layer decomposition.

  1. Bold header: Uncertainty-Aware Dynamic Feature Fusion

The fusion mechanism can dynamically re-weight each layer using a score calculated from both Intrinsic Feature Salience (Projection Score) and Predictive Reliability (Uncertainty Score), leading to a fused representation that ensures the decision relies on protocol layers with the strongest representational clarity for the specific sample.

  1. Bold header: Efficient Representation Compression

By maximizing mutual information between raw features and latent representations, the system can reduce complexity, as demonstrated by achieving a compression ratio of ≈ 2× in PACC embeddings while ensuring that the representation should be substantially smaller than raw-bit encodings to enable scalable training and low-latency inference.

  1. Bold header: Optimized Class Imbalance Handling

The framework incorporates a class-balancing factor, where the optimization objective is modified by reweighting samples based on their effective volume, which allows the model to manage class imbalances effectively while avoiding the degradation observed when pushing the balancing factor towards 1.0.

  1. Bold header: Interpretable Layer Contribution Analysis

The system provides interpretability at the layer level, allowing researchers to clarify which layers are contributing shared versus unique evidence, which is valuable for debugging and for deployments under partial observability.

Abstract

Network traffic classification underpins network security and management but faces growing challenges from pervasive encryption and evolving protocols. Existing representations involve clear trade-offs: hand-crafted flow statistics are efficient but lossy, raw-bit encodings can be accurate but costly, and pre-trained embeddings support transfer but often flatten the protocol stack and entangle cross-layer signals. We observe substantial redundancy both across and within network layers, which existing paradigms do not explicitly address, wasting capacity and encouraging shortcut learning that degrades generalization. To address this, we propose PACC, a redundancy-aware cross-layer representation framework. PACC models protocol layers as multiview inputs and learns faithful, compact projections factorized into shared (cross-layer) and private (layer-specific) components. It incorporates an information-preserving sparse segment representation to reduce structural repetition and supervised intra-layer filtering to suppress task-irrelevant semantic redundancy. A behavior-guided shared/private decomposition aligns cross-layer consensus while retaining layer-specific information, supported by information-theoretic analysis. Across encrypted application classification, IoT device identification, benign/malicious traffic classification, and Tor traffic detection, PACC achieves the best overall performance. On encrypted traffic, it achieves an F1 score of 0.9685, substantially outperforming existing baselines while using approximately 15x fewer computes and less GPU memory than the latest pre-trained traffic model.

Sources

Related papers