Network traffic classification enables website fingerprinting, intrusion detection, and Quality of Service management. However, developing methods that capture stable and generalizable traffic patterns under realistic deployment conditions remains challenging. We introduce FlowCLIP, a contrastive pretraining framework for learning encrypted traffic representations using only side-channel features: packet inter-arrival times, packet sizes, and packet directions. FlowCLIP uses raw domain names as textual supervision by aligning traffic flow representations with domain name representations through a CLIP-style contrastive objective. The pretrained traffic encoder is then frozen and evaluated through linear probing on canonicalized domain name labels. We evaluate FlowCLIP on a large-scale QUIC traffic dataset using a time-based protocol, where models are trained on Week 1 traffic and evaluated on Weeks 2-4. FlowCLIP outperforms competitive machine learning baselines across all evaluation weeks and achieves accuracy and weighted F1 comparable to a supervised model with the same architecture trained directly on the downstream classification task. These results suggest that raw domain names provide an effective textual supervision signal for learning transferable encrypted traffic representations.

翻译：暂无翻译