Enhanced Encrypted IoT Malicious Traffic Detection via Adaptive Fusion and Focal Loss: An Improved Heterogeneous Graph Approach

The rapid proliferation of the Internet of Things (IoT) has significantly expanded the attack surface of network environments, making malicious traffic detection a critical security challenge. The widespread adoption of encryption technologies further exacerbates this challenge, as traditional plaintext feature-based detection methods are no longer effective. Although existing deep learning approaches have shown progress in encrypted traffic classification, they still face limitations in feature fusion strategies and the accurate identification of hard-to-classify samples. To address these shortcomings, this paper proposes an enhanced approach based on a dual-granularity heterogeneous graph neural network framework. Specifically, we introduce an adaptive feature fusion mechanism that dynamically adjusts feature weights and employs cross-view attention to fully exploit the complementarity of features across different granularities. Additionally, we replace the conventional cross-entropy loss with Focal Loss, enabling the model to focus more on challenging MitM (Man-in-the-Middle) samples during training. Extensive experiments conducted on the CIC-IIoT 2025 and IoT-23 datasets demonstrate that the proposed approach achieves significant improvements in both weighted average accuracy and F1 score over baseline methods. Compared to the state-of-the-art encrypted traffic classification framework, MH-Net, the F1 score improves by 11.5% on the CIC-IIoT dataset, while also significantly reducing the misclassification of MitM samples as benign traffic. These results confirm the effectiveness and superiority of the proposed method. This work provides a practical solution for encrypted traffic classification in IoT environments, enabling more accurate detection of malicious traffic and improving the security of IoT networks.