Flow-Based User Click Identification in Encrypted Web Traffic

Identifying user clicks from passive traces is the fundamental task for user behavior analysis, which is important for understanding modern web usage and providing optimized personalized service. With the widespread adoption of encryption protocols, identifying user clicks in encrypted web traffic becomes more and more challenging. Existing studies on user click identification mainly focus on information extracted from request packets, which makes them difficult to apply over encrypted traffic and large network. In this paper, we propose a novel flow-based method for user click identification in encrypted web traffic. We observe that the flows directly driven by user clicks have uniform communication patterns for classification. Thus, we turn user click identification into a flow classification problem and apply a GNN-based classifier to learn flow patterns accurately. We collect two real-world traffic datasets and conduct experiments to demonstrate the effectiveness of the proposed method. Experimental results show that our proposed model outperforms the existing baseline methods in terms of performance and stability.