A Graph Neural Network Approach for Identifying Decentralized Applications in Encrypted Traffic

Abstract

Cryptographic network traffic classification has been challenged by the advent of decentralized applications (DApps), especially those based on blockchain platforms like Ethereum. It is difficult to identify DApps using traditional methods, such as port-based identification or deep packet inspection, due to their encryption and protocol similarities. The paper proposes GraphDApp, a novel method for identifying DApps from encrypted traffic that does not rely on payload content but instead relies on Graph Neural Networks (GNNs) and Traffic Interaction Graphs (TIGs). Conventional techniques miss structural patterns and interactions in communication flows due to their representation as graphs. A real-world dataset demonstrates that GraphDApp is significantly more accurate, more efficient in training, and more resilient to unmonitored DApps than existing methods, with near-perfect accuracy and stable performance under diverse conditions. We present a GNN-based framework for detecting decentralized applications (DApps) in encrypted traffic, achieving 92.1% F1-score by analyzing transaction patterns. Our method outperforms traditional classifiers by 18.3% while preserving full traffic encryption.