Adapting Large Language Models for Encrypted Traffic Analysis Services

Open Webpage

Yi Liu, Xiang Zheng, Chengjun Cai, Xingliang Yuan, Cong Wang

Published: 09 Mar 2026, Last Modified: 25 May 2026IEEE Transactions on Services ComputingEveryoneRevisionsBibTeXCC BY-SA 4.0
Abstract: As encrypted traffic grows, traditional rule-based and deep learning methods struggle with engineering costs and encryption complexity. While Large Language Models (LLMs) offer promise for traffic analysis via pre-trained feature learning, they face challenges in handling diverse tasks, retaining pre-training knowledge, and adapting efficiently. To address these issues, we propose a new traffic representation learning method and a new Parameter-Efficient Fine-Tuning (PEFT) method for multi-task encrypted traffic analysis services, called TrafficLLM. TrafficLLM alleviates task heterogeneity by utilizing a universal multi-task prompt template and addresses pre-training knowledge forgetting by integrating Singular Value Decomposition based Low-Rank Adaptation (SVD-LoRA). To further reduce the cost of adapting to multiple tasks, we combine the strengths of the Mixture of Experts (MoE) for multi-task learning with SVD-LoRA for PEFT, enabling efficient multi-task traffic analysis. Additionally, we introduce task-aware gating functions to dynamically assign different weights to experts, facilitating the efficient fusion of expert knowledge. Comprehensive experiments on 7 datasets across 5 downstream tasks demonstrate that TrafficLLM delivers superior analysis performance and resource efficiency compared to state-of-the-art models, including DeepSeek, NetGPT, ET-BERT, and TFE-GNN. Detailed analysis of throughput, memory usage, and latency further highlights the practical advantages of TrafficLLM. © 2026 IEEE. All rights reserved, including rights for text and data mining, and training of artificial intelligence and similar technologies. Personal use is permitted, but republication/redistribution requires IEEE permission.