GraphMux: A graph-based framework for encrypted traffic classification

The growing dominance of encrypted network traffic and modern encryption protocols (TLS 1.3, QUIC, DoH) poses significant challenges for accurate network classification, particularly as many existing approaches rely on text- or image-based representations, which fail to adequately capture the inherent structural relationships present in network communication—relationships that are more naturally represented as graphs. In this work, we introduce GraphMux, a graph-based framework that leverages line graph transformations to fuse multiple graph views into a unified representation. We also present three graph-based flow representations (TIG+Chain, StarBurst, and 2Chain) designed to capture both temporal burst dynamics and client–server interaction patterns, using only packet time, direction, and length information, without incorporating any unencrypted statistical features. We evaluate our approach on three datasets: two academic datasets (UTMobileNetTraffic2021 and QUIC PCAP) and a commercial dataset (Flash), using four graph embedding architectures. Across all datasets, GraphMux consistently achieves superior performance, and the proposed graph constructions often yield the best results. Additional experiments examining attribute-selection strategies reveal a strong positive relationship between well-aligned feature assignments and classification accuracy, underscoring the importance of principled attribute design when constructing graph representations for encrypted traffic.