# Traffic-MoE: A Sparse Foundation Model for Network Traffic Security Analysis Source: [Traffic-MoE: A Sparse Foundation Model for Network Traffic Security Analysis]() Collection index: [llms.txt]() Data updated: 2026-07-10T05:00:01.276Z Authors: Jiajun Zhou, Changhui Sun, Wentao Fu, Meng Shen, Shanqing Yu, Qi Xuan Published: 2026-01-01T14:24:58.000Z ## Abstract As adversaries increasingly weaponize encryption and protocol obfuscation to evade traffic detection, traditional methods are rendered obsolete, necessitating deep learning to unmask sophisticated threats. However, the prohibitive computational costs of existing large models create a critical defense gap, hindering their deployment in real-time and throughput-sensitive environments. To close this vulnerability, we introduce Traffic-MoE, a sparse foundation model tailored for traffic security analysis. By dynamically routing traffic tokens to a small subset of specialized experts, Traffic-MoE effectively decouples model capacity from computational overhead. Extensive evaluations across four security-oriented tasks demonstrate that Traffic-MoE achieves state-of-the-art or highly competitive performance compared to leading competitors. Crucially, it delivers a 70.42% increase in throughput, reduces inference latency by 41.39% while significantly optimizing GPU memory consumption. Beyond efficiency, Traffic-MoE exhibits superior robustness against adversarial traffic shaping and maintains strong detection capabilities in few-shot scenarios, establishing a scalable and resilient paradigm for modern network traffic security analysis. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Network Traffic Analysis on CICIoMT Time-shift 2024](): Network Traffic Analysis; CICIoMT Time-shift 2024; Accuracy: 82.19. - [Network Traffic Analysis on CICIoMT2024 Proportion-shift](): Network Traffic Analysis; CICIoMT2024 Proportion-shift; Accuracy: 97.27. - [Network Traffic Analysis on CICIoMT Compose-shift 2024](): Network Traffic Analysis; CICIoMT Compose-shift 2024; Accuracy: 80.71. - [Network Traffic Analysis on CICIoT2023 Proportion-shift](): Network Traffic Analysis; CICIoT2023 Proportion-shift; Accuracy: 80.52. - [Network Traffic Analysis on CICIoT Compose-shift 2023](): Network Traffic Analysis; CICIoT Compose-shift 2023; Accuracy: 63.31. - [Service Classification on ISCXVPN NonVPN 2016](): Service Classification; ISCXVPN NonVPN 2016; ACC: 76.13. - [Service Classification on ISCXVPN 2016 (Mixed)](): Service Classification; ISCXVPN 2016 (Mixed); Accuracy: 76.79. - [Traffic Detection on ISCXTor NonTor 2016](): Traffic Detection; ISCXTor NonTor 2016; Accuracy: 98.27. - [Traffic Detection on ISCX Tor 2016](): Traffic Detection; ISCX Tor 2016; Accuracy: 90.89. - [IoT/IoMT Attack Detection on CICIoMT 2024 (test)](): IoT/IoMT Attack Detection; CICIoMT 2024 (test); Accuracy: 97.69. - [Network Traffic Analysis on CICIoT2023 Time-shift](): Network Traffic Analysis; CICIoT2023 Time-shift; Accuracy: 50.31. - [IoT/IoMT Attack Detection on CICIoT 2023 (test)](): IoT/IoMT Attack Detection; CICIoT 2023 (test); Mean F1 Score: 78.24. ## Original sources and implementation [Original paper]() [PDF]()