Capsule Network Approach for Robust Encrypted Traffic Detection and Interpretability in Complex Network Environments

Abstract

With the growth of encrypted traffic, traditional detection and classification methods can no longer meet the security requirements of encrypted traffic. To address these issues, this paper designs a stable encrypted traffic detection framework based on capsule networks. This new technology can obtain temporal, statistical, and directional flow data through an effective feature engineering system, using multi-layer capsules to maintain the structural dependencies of encrypted sessions. Experimental validation on various enterprise traffic benchmark datasets shows that capsule networks outperform deep learning baselines, such as LSTM and CNN, under strong encryption and adversarial perturbations, with an average accuracy improvement of 4% and a maximum F1-score increase of 5%. Based on the aforementioned visual and quantitative analyzes, the model achieves good performance stability by reducing false positives and false negatives. Through t-SNE projection and activation mapping, the model has high interpretability. According to the deployment results, the framework can maintain detection accuracy and meet the needs of large-scale systems. Capsule networks not only provide transparent and easy-to-use operational security tools but also extend the technical limitations of encrypted traffic detection. According to the research, it is hoped that in the near future, some new, reliable, and easy-to-understand network defense systems will be developed.