Curv-Tail: Lightweight Long-Tailed Encrypted Traffic Classification with Discrete Packet-Length Encoding and Lorentz Prototypes

Curv-Tail achieves Tail-F1 scores of 85.70% and 46.30% on NUDT-Mobile (300 mobile-app classes) and DataCon-Website (100 encrypted proxy/VPN website classes) under natural long-tailed class frequencies, with only 0.84M parameters and 46.07M MACs per flow—using 98.48% fewer parameters and achieving 10.2× the batch inference throughput of MM4Flow at FP32 precision on an RTX 4090, with an amortized per-flow latency of 0.1359 ms at batch size 256.

§3.2, §3.4, Table 1, Fig. 4(a) evaluation ml-classifiertraffic-shapewebsite-fingerprint generic

Discrete packet-length tokenization is the single most influential component in Curv-Tail: replacing it with continuous length encoding reduces Tail-F1 by 11.04 percentage points on DataCon-Website (47.23% → 36.19%), a larger ablation gap than removing Lorentz geometry (−2.12 pp) or the length-retention auxiliary objective (−1.02 pp) combined.

§3.3, Table 3 detection ml-classifiertraffic-shape generic

Classifier-level long-tail corrections applied to a fine-tuned and frozen ET-BERT encoder on NUDT-Mobile—including logit adjustment, effective-number reweighting, class-balanced retraining (cRT), and feature mixup—improve Tail-F1 by at most 0.08 percentage points over the base ET-BERT (82.79%); Curv-Tail's end-to-end joint representation learning outperforms the best correction by 2.83 points in Tail-F1 and 3.05 points in Macro-F1.

§3.2, Table 2 evaluation ml-classifiertraffic-shape generic

On NUDT-Mobile, Curv-Tail achieves group-wise Macro-F1 of 96.98% on head classes (top 50% by training frequency), 92.84% on body classes, and 85.70% on tail classes, with per-group gains over the strongest baseline (MM4Flow) of 0.65, 1.12, and 4.97 percentage points respectively—demonstrating that architectural improvements disproportionately benefit rare-class detection and that tail-class accuracy is approaching head-class accuracy.

§3.2, Fig. 3 detection ml-classifiertraffic-shape generic

Website fingerprinting over encrypted proxy/VPN tunnels on DataCon-Website reaches only 46.30% Tail-F1 for infrequent destination classes even with the best evaluated method—substantially below the 85.70% Tail-F1 achieved on mobile applications (NUDT-Mobile)—reflecting that rare encrypted website traffic classes remain significantly harder for ML classifiers regardless of model architecture improvements.

§3.2, Table 1 detection ml-classifierwebsite-fingerprint generic