A New Perspective on CNN-Based Encrypted Traffic Classification: Data Preprocessing and Generalization Performance Analysis

Given the increasing prevalence of HTTPS communication on the Internet, the identification and classification of encrypted network traffic has become critical challenges for information security. Although deep learning models have demonstrated substantial performance in this area, existing research often relies on public datasets and prioritizes model architecture optimization over robust data preprocessing, limiting generalization performance when evaluated on external independent test datasets. To address this issue, this paper proposes a novel session-based approach for traffic dataset partitioning and preprocessing, utilizing the initial packets of each session as an input sample to enhance the model generalization performance. Furthermore, a Multi-Scale Convolutional Residual Network (MSCRNet) is designed and rigorously evaluated on both ISCXVPN2016 and the newly constructed LENS dataset. The experimental results show that the proposed initial-packets based preprocessing method combined with MSCRNet achieves an optimal generalization F1-score of 87.66% on the independent test dataset, representing a significant average improvement of 41.86% in generalization F1-score compared to conventional random packet partitioning schemes. Finally, we present a detailed empirical analysis of the impact of key preprocessing parameters—initial packet count, truncation length, and session quantity—on model performance, offering valuable insights for improving the robustness and efficacy of encrypted traffic classification systems.