Graph-based deep learning methods have been widely employed in encrypted traffic analysis to exploit latent correlations across different granularities. However, while complex preprocessing pipelines and sophisticated model structures often achieve strong performance, they may obscure inherent protocol semantics during representation learning. Moreover, the hierarchical structure of protocol layers and their corresponding fields, defined by protocol specifications and routinely utilized in manual traffic analysis, remains underexplored in existing learning frameworks. In this paper, we propose Protocol Tree Graph Attention with Mixture of Experts (PTGAMoE), a semantic-preserving hierarchical graph-based expert framework for encrypted traffic analysis. The field-based graph construction and expert committee design enable PTGAMoE to quantify the model's preferences for specific fields and protocols. Extensive experimental results on representative benchmark datasets under strict no-data-leakage settings demonstrate that PTGAMoE significantly outperforms state-of-the-art (SOTA) models. Furthermore, the semantic-preserving design provides interpretable insights into protocol-level feature importance and expert-level contributions, reflecting the model's decision-making logic in encrypted traffic classification tasks.

翻译：基于图的深度学习方法已被广泛应用于加密流量分析，以挖掘不同粒度下的潜在关联。然而，虽然复杂的预处理流程和精巧的模型结构常能取得优异性能，但它们可能在表示学习过程中掩盖固有的协议语义。此外，由协议规范定义并在人工流量分析中常规使用的协议层及其对应字段的层次化结构，在现有学习框架中仍未得到充分探索。本文提出一种保留语义的层次化图专家框架——协议树图注意力混合专家模型（PTGAMoE），用于加密流量分析。基于字段的图构建与专家委员会设计使PTGAMoE能够量化模型对特定字段和协议的偏好。在严格的无数据泄露设置下，基于代表性基准数据集的广泛实验结果表明，PTGAMoE显著优于当前最先进的模型。此外，该保留语义的设计为协议级特征重要性和专家级贡献提供了可解释的洞察，反映了模型在加密流量分类任务中的决策逻辑。