International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
SPLIT LEARNING–BASED SECURE TRAFFIC CLASSIFICATION FOR PRIVACY-SENSITIVE NETWORKS
Annapurna Yadav1 , Mrs. Arifa Khan2
1Master of Technology, Computer Science and Engineering, Lucknow Institute of Technology, Lucknow, India
2Assistant Professor, Department of Computer Science and Engineering, Lucknow Institute of Technology, Lucknow, India
Abstract - The rapid growth of networked systems and encrypted communications has made network traffic classification a critical component of modern cybersecurity. However, traditional traffic classification techniques, particularly centralized machine learning and Deep Packet Inspection (DPI), pose significant privacy risks due to their reliance on direct access to sensitive network data. Although federated learning offers partial privacy preservation, it remains vulnerable to information leakage through shared gradients. To address these challenges, this paper proposes a split learning–based secure traffic classification framework designed for privacy-sensitive network environments. In the proposed approach, a deep neural network is partitioned between client devices and a central server, enabling collaborative model training without sharing raw network traffic data. Clients process local data through initial layers and transmit only intermediate activations to the server, whichcompletesclassificationandreturnsgradientsformodel updates. The framework is evaluated using benchmark datasets, including CICIDS2017 and UNSW-NB15, with performance measured through accuracy, precision, recall, and F1-score. Experimental results demonstrate that the proposed model achieves high classification accuracy while significantlyenhancingdataprivacycomparedtocentralized and traditional machine learning approaches. The findings highlight that split learning provides an effective balance betweenprivacypreservationandmodelperformance,making it a promising solution for secure traffic analysis in modern distributed network environments.
Key Words: Split Learning, Traffic Classification, Privacy-PreservingMachineLearning,NetworkSecurity, Deep Learning, Intrusion Detection, Distributed Learning.
1. INTRODUCTION
Therapidevolutionofdigitalcommunicationtechnologies hastransformedmodernnetworkinfrastructures,leadingto unprecedentedgrowthindatagenerationandtransmission. Withtheproliferationofcloudcomputing,InternetofThings (IoT), and real-time applications, networks have become highlydynamicandcomplex.Thisgrowthhassignificantly increasedthedemandforintelligenttrafficmonitoringand classification systems to ensure network security and performance.However,theintegrationofmachinelearning techniques into traffic analysis has introduced new
challengesrelatedtodataprivacyandsecurity.Traditional approachesoftenrelyoncentralizeddatacollection,which exposessensitiveinformationandcreatesvulnerabilitiesin privacy-sensitive environments. Therefore, developing secure and privacy-preserving traffic classification mechanisms has become a critical research priority in modern cybersecurity systems (Cisco, 2023; Nguyen and Armitage,2008).
1.1 Background
1.1.1 Growth of Network Traffic and IoT Ecosystems
TheexpansionofIoTdevicesanddigitalserviceshasledto exponential growth in global network traffic. Modern networks support a wide range of applications, including smart healthcare, industrial automation, and cloud-based services,allofwhichcontinuouslygeneratelargevolumesof data.Thisrapidincreasein trafficcomplexitynecessitates advanced analytical techniques to monitor and manage networkbehavioreffectively.Traditionalrule-basedsystems arenolongersufficienttohandlesuchscaleanddiversity, leading to the adoption of machine learning and deep learning methods for traffic analysis (Aceto, Ciuonzo and Montieri,2019).
1.1.2
Importance of Traffic Classification in Cybersecurity
Traffic classification plays a vital role in identifying and categorizing network flows, enabling the detection of malicious activities such as distributed denial-of-service attacks,malwarecommunication,andunauthorizedaccess. Accurate classification allows network administrators to enforcesecuritypolicies,allocateresourcesefficiently,and detect anomalies in real time. With the increasing sophistication of cyber threats, machine learning-based classification techniques have become essential for enhancingdetectionaccuracyandadaptabilityindynamic networkenvironments(MooreandZuev,2005).
1.1.3
Limitations of Deep Packet Inspection (Privacy Issues)
DeepPacketInspection(DPI)hastraditionallybeenusedfor trafficclassificationbyanalyzingpacketpayloads.WhileDPI provideshighaccuracy,itraisessignificantprivacyconcerns
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
becauseitrequiresaccesstosensitiveuserdata.Moreover, the widespread adoption of encryption protocols such as HTTPS and TLS has reduced the effectiveness of payloadbased inspection. Regulatory requirements and data protection laws further restrict the use of intrusive monitoring techniques, highlighting the need for privacypreservingalternatives(Dainotti,PescapeandClaffy,2012).
1.2 Problem Statement
1.2.1
Centralized Machine Learning and Privacy Leakage
Centralizedmachinelearningapproachesrequirecollecting largevolumesofnetworktrafficdatainacentralrepository for training models. Although effective in terms of performance,thisapproachexposessensitiveinformationto potential breaches and unauthorized access. In privacysensitive environments such as healthcare and financial systems, such risks are unacceptable, making centralized learningunsuitableformodernsecureapplications(Shbair etal.,2016).
1.2.2 Federated Learning and GradientLeakage Risks
Federatedlearningwasintroducedtoaddressdataprivacy concerns by enabling decentralized model training. However,recentstudieshaveshownthatgradientsshared duringtrainingcanstillleaksensitiveinformationthrough inference attacks. These vulnerabilities limit the effectiveness of federated learning in scenarios requiring strongprivacyguarantees(Kairouzetal.,2021).
1.2.3
Need for Stronger Privacy-Preserving Frameworks
Given the limitations of both centralized and federated approaches,thereisaclearneedformorerobustprivacypreservingframeworks.Suchframeworksmustensurethat sensitivedataremainslocalwhilestillenablingcollaborative model training.Splitlearninghasemergedasa promising solutionbytransmittingonlyintermediaterepresentations insteadofrawdataorgradients,therebyreducingtheriskof informationleakage(Vepakommaetal.,2018).
1.3 Research Motivation
1.3.1
Protection of Sensitive Network Data
The increasing reliance on digital systems has made the protection of sensitive network data a critical concern. Unauthorized access to traffic data can lead to severe consequences, including financial loss, privacy violations, and regulatory penalties. Therefore, ensuring secure data handlingduringmachinelearningmodeltrainingisessential for maintaining trust and compliance in modern network environments(Roman,ZhouandLopez,2013).
1.3.2 Demand for Privacy-Aware AI Systems
With the growing adoption of artificial intelligence in cybersecurity,thereisarisingdemandforprivacy-awareAI systems.Organizationsrequireintelligentsolutionsthatcan analyze network traffic without compromising user confidentiality. This demand has driven research toward distributed learning paradigms that balance performance withprivacyprotection(Raskaretal.,2019).
1.3.3 Limitations of Existing Distributed Learning Approaches
Despite advancements in distributed learning, existing approaches such as federated learning and secure multiparty computation still face challenges related to communicationoverhead,scalability,andprivacyleakage. These limitations highlight the need for alternative frameworks that can provide stronger privacy guarantees while maintaining computational efficiency and model accuracy(Lietal.,2020).
1.4 Research Objectives
Theprimaryobjectiveofthisresearchistodesignasecure and efficient traffic classification framework using split learning. The study aims to develop a distributed architecture that enables collaborative model training without sharing raw network traffic data. Another key objectiveistoenhanceprivacyprotectionwhilemaintaining high classification accuracy comparable to traditional machine learning and deep learning models. Additionally, the research evaluates the proposed framework using benchmark datasets and compares its performance with existingapproachestodemonstrateitseffectivenessinrealworldscenarios.
1.5 Contributions of the Paper
Thisresearchmakesseveralsignificantcontributionstothe field of privacy-preserving network traffic classification. First,itproposesanovelsplitlearning–basedarchitecture specifically designed for secure traffic classification in privacy-sensitivenetworks.Unliketraditionalapproaches, the proposed framework ensures that raw network data remains on client devices, thereby minimizing the risk of dataexposure.
Second,thestudyintroducesaprivacy-preservingtraining mechanism that relies on the exchange of intermediate activations rather than raw data or gradients, enhancing confidentiality during model training. Third, the research provides a comprehensive performance evaluation by comparing the proposed model with traditional machine learning and deep learning baselines, demonstrating its superiorityintermsofbothaccuracyandprivacyprotection.
Finally,thepaperpresentsanin-depthanalysisofthetradeoffbetweenprivacypreservationandmodelperformance,
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
offeringvaluableinsights intothepractical deployment of split learning in real-world network environments. These contributions establish the proposed framework as a promising solution for secure and scalable traffic classificationsystems.
2. LITERATURE SURVEY
The field of network traffic classification has evolved significantly with advancements in machine learning and distributed computing. Early approaches relied on rulebased and payload inspection techniques, while recent developmentshaveshiftedtowardintelligentandprivacyawarelearningmodels.Thissectionreviewsexistingworkin traditional traffic classification, deep learning-based approaches, and privacy-preserving frameworks, highlighting their strengths, limitations, and security challenges.
2.1 Traditional Traffic Classification
2.1.1
DPI-Based Methods
Deep Packet Inspection (DPI) has been one of the earliest andmostwidelyusedtechniquesfortrafficclassification.It operatesbyanalyzingpacketpayloadstoidentifyapplication types and detect malicious activities. DPI provides high accuracybecauseitdirectlyexaminesthecontentofnetwork packets.However,thisapproachhassignificantlimitations inmodernnetworksduetotheincreasinguseofencryption protocols such as HTTPS and TLS. Moreover, DPI raises serious privacy concerns as it requires access to sensitive user data, making it unsuitable for privacy-sensitive environments and regulated industries (Dainotti, Pescape andClaffy,2012).
2.1.2
Machine Learning Approaches (SVM, RF, DT)
To overcome the limitations of DPI, machine learning techniquessuchasSupportVectorMachines(SVM),Random Forest (RF), and Decision Trees (DT) have been widely adopted for traffic classification. These methods rely on statisticalfeaturesextractedfrompacketheadersandflowlevel data rather than payload content. Machine learning approachesimprovescalabilityandcanadapttonewtraffic patterns.However,theyoftenrequirecentralizeddatasets for training and struggle to capture complex patterns in highlydynamicnetwork environments.Additionally,their performanceishighlydependentonfeatureengineeringand dataquality(MooreandZuev,2005).
2.2 Deep Learning-Based Traffic Classification
2.2.1
CNN, RNN, and Deep Packet Approaches
Deep learning models have significantly improved traffic classificationbyautomaticallylearninghierarchicalfeature representations from raw or minimally processed data. Convolutional Neural Networks (CNNs) are effective in
capturing spatial patterns in traffic data, while Recurrent NeuralNetworks(RNNs)areusefulformodelingtemporal dependencies in sequential traffic flows. The Deep Packet approachfurtherdemonstratedthatdeepneuralnetworks can classify encrypted traffic directly without relying on manual feature extraction, achieving high accuracy (Lotfollahietal.,2020).
2.2.2 Strengths and Limitations
Although deep learning models provide superior performancecomparedtotraditionalmethods,theytypically requirelargeamountsofcentralizeddatafortraining.This requirementintroducesprivacyrisks,assensitivenetwork traffic data must be collected and stored in a central repository. Furthermore, deep learning models are computationally intensive and may not be suitable for resource-constrainedenvironmentssuchasIoTnetworks. These challenges have motivated the development of distributed and privacy-preserving learning techniques (Abbasietal.,2021).
2.3 Privacy-Preserving Learning
2.3.1
Federated Learning: Concept and Limitations
Federated Learning (FL) enables collaborative model trainingacrossmultipleclientswithoutsharingrawdata.In this approach, each client trains a local model and shares onlymodelupdatesorgradientswithacentralserver,which aggregatesthemtoformaglobalmodel.WhileFLimproves data privacy compared to centralized learning, it is still vulnerable to privacy attacks. Recent studies have shown that sensitive information can be inferred from shared gradientsthroughtechniquessuchasgradientinversionand membershipinferenceattacks,limitingitseffectivenessin high-securityenvironments(Kairouzetal.,2021).
2.3.2 Split Learning: Concept and Advantages
Splitlearningisadistributedlearningparadigminwhicha neuralnetworkispartitionedbetweenclientandserver.The clientprocessestheinitiallayersusinglocaldataandsends intermediateactivationstotheserver,whichcompletesthe remaining computation. Unlike federated learning, split learning does not require sharing gradients or full model parametersfromtheclientside,therebyreducingtheriskof information leakage. This architecture enables efficient collaboration while preserving data privacy, making it particularlysuitableforprivacy-sensitiveapplicationssuch as healthcare and network security (Vepakomma et al., 2018).
2.4 Security Threats in Split Learning
2.4.1
Reconstruction Attacks
Despite its privacy advantages, split learning is not inherentlysecure.Reconstructionattacksaimtorecoverthe
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
original input data from intermediate activations transmitted between client and server. Studies have demonstrated that these activations can retain significant informationabouttheoriginaldata,allowingadversariesto reconstruct sensitive inputs under certain conditions (Pasquinietal.,2021).
2.4.2
Label Leakage
Label leakage is another critical threat in split learning, wheretheservercaninferthelabelsoftheclient’sdataby analyzinggradientsorintermediaterepresentations.Thisis particularlyproblematicinclassificationtaskswherelabels themselves may contain sensitive information, such as identifyingmalicioustrafficpatterns(Lietal.,2021).
2.4.3
Model Inversion Attacks
Model inversionattacksexploitthetrained model toinfer sensitive information about the training data. In split learning,adversariescanuseintermediaterepresentations and model outputs to reconstruct input features or infer private attributes. These attacks highlight the need for additional security mechanisms to protect data confidentiality(Erdoğanetal.,2022).
2.5 Existing Defense Mechanisms
2.5.1 Differential Privacy
Differential Privacy (DP) is a widely used technique for protectingsensitiveinformationinmachinelearningmodels. It works by adding controlled noise to data or model parameters,ensuringthatindividualdatapointscannotbe identified.DPprovidesformalprivacyguaranteesbutmay reducemodelaccuracyifexcessivenoiseisintroduced(Yuan etal.,2021).
2.5.2
Encryption Techniques
Encryption-based approaches, such as homomorphic encryption and secure multi-party computation, allow computations to be performed on encrypted data without revealing the original inputs. These techniques provide strong security guarantees but often introduce significant computationaloverhead,makingthemchallengingtodeploy inreal-timenetworkenvironments(Trivedietal.,2026).
2.5.3
Adversarial Training
Adversarialtrainingenhancesmodelrobustnessbytraining the model to resist potential attacks. In split learning, adversarialtechniquescanbeusedtoreducetheamountof sensitiveinformationcontainedinintermediateactivations, thereby mitigating reconstruction and inference attacks. However,designingeffectiveadversarialdefenseswithout affecting model performance remains a challenging task (Zhengetal.,2022).
2.6 Research Gap
Despite significant progress in traffic classification and privacy-preservingmachinelearning,severalresearchgaps remain. Most existing traffic classification systems either focus on improving accuracy or enhancing privacy, but rarely address both aspects simultaneously. While split learningoffersapromisingsolutionforprivacypreservation, itsapplicationinnetworktrafficclassificationisstilllimited. Additionally, existing studies often overlook the security vulnerabilities associated with split learning, such as reconstructionandinferenceattacks.Therefore,thereisa needfora comprehensiveframework thatintegratessplit learningwithrobustsecuritymechanismswhilemaintaining high classification performance. This research aims to addressthesegapsbyproposingasecureandefficientsplit learning–based traffic classification model tailored for privacy-sensitivenetworkenvironments.
3. PROPOSED METHODOLOGY
This section presents the proposed split learning–based framework for secure network traffic classification in privacy-sensitive environments.Themethodology focuses ondesigninga distributeddeeplearning architecturethat enables collaborative model training without sharing raw network traffic data. The framework integrates data preprocessing,neuralnetworkmodeling,andsplitlearning mechanisms to achieve high classification accuracy while preservingdataconfidentiality.
3.1 System Overview
3.1.1
Description of Split Learning Framework
The proposed system is based on the concept of split learning, a distributed deep learning approach where a neural network is divided into two segments and trained collaboratively. In this framework, client devices process localdatathroughtheinitiallayersofthemodelandsend intermediate representations, known as activations, to a central server. The server completes the remaining computations and generates classification outputs. This approachensuresthatsensitivenetworktrafficdataremains withintheclientenvironment,therebyreducingtheriskof dataleakagewhilestillenablingeffectivemodeltraining.
3.1.2 Client–Server Architecture
Thearchitectureoftheproposedsystemconsistsofmultiple clientnodesandacentralizedserver.Eachclientnodeholds localnetworktrafficdataandperformsinitialcomputations using a portion of the neural network. The server is responsibleforexecutingtheremaininglayersofthemodel and producing final predictions. Communication between theclientandserveroccursthroughasecurechannelthat exchanges intermediate activations and gradient updates. Thiscollaborativearchitectureenablesdistributedlearning
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
while maintaining data privacy and reducing the need for centralizeddatastorage.
3.2 Split Learning Framework Design
3.2.1
Client-Side Model
The client-side model represents the first segment of the splitneuralnetworkandoperatesonlocalnetworktraffic data.Theprocessbeginswithdatapreprocessing,whereraw trafficdataiscleaned,normalized,andtransformedintoa suitableformatformodeltraining.Afterpreprocessing,the data is passed through the initial layers of the neural network, which extract basic features and generate intermediate representations. These activations capture essentialpatternsinthedatawithoutrevealingtheoriginal input, ensuring privacy preservation. The client then transmits these activations to the server for further processing.
3.2.2
Server-Side Model
Theserver-sidemodelconstitutesthesecondsegmentofthe neural network and is responsible for completing the classification process. Upon receiving intermediate activations from the client, the server processes them throughdeeperlayersofthenetworktoextracthigher-level features.Thefinallayerofthemodelproducesclassification outputs, identifying whether the traffic is normal or malicious.Duringtraining,theservercomputesthelossand performsbackpropagationtogenerategradients,whichare then sent back to the client for updating its model parameters.
3.2.3
Communication Protocol
Thecommunicationprotocolbetweentheclientandserver is a critical component of the split learning framework. During the forward pass, the client sends intermediate activations to the server instead of raw data. In the backwardpass,theservercomputesgradientsandtransmits them back to the client. This bidirectional communication enablescollaborativetrainingwhileensuringthatsensitive dataremainslocal.Securecommunicationchannelsareused toprotectthetransmittedinformationfrominterceptionor tampering, thereby enhancing the overall security of the system.
3.3 Neural Network Architecture
3.3.1
Input Layer (Traffic Features)
The input layer of the neural network receives feature vectorsextractedfromnetworktrafficdata.Thesefeatures includeflow-basedandstatisticalattributessuchaspacket size,flowduration,protocoltype,andpacketcount.Byusing metadata instead of raw packet payloads, the model maintains privacy while still capturing essential traffic characteristics.
3.3.2 Hidden Layers (CNN / Dense)
The hidden layers of the network are responsible for learningcomplexpatternsinthetrafficdata.Convolutional layerscanbeusedtoextractspatialpatternsfromfeature matrices, while dense (fully connected) layers help in learning high-level representations. Activation functions suchasReLUintroducenon-linearity,enablingthemodelto captureintricaterelationshipswithinthedata.Theselayers aredividedbetweentheclientandserverbasedonthesplit learningarchitecture.
3.3.3 Output Layer (Classification)
Theoutputlayerproducesthefinalclassificationresultsby assigningeachtrafficinstancetoaspecificcategory,suchas normal or malicious. A softmax or sigmoid function is typicallyusedtogenerateprobabilityscoresforeachclass. Theoutputenablesthesystemtoidentifypotentialsecurity threatsandsupportreal-timedecision-makinginnetwork environments.
3.4 Model Partitioning Strategy
3.4.1 Split Point Selection
A key aspect of split learning is determining the optimal point at whichthe neural network is divided betweenthe clientandserver.Thesplitpointistypicallychosenbasedon thecomplexityofthemodelandthesensitivityofthedata. Placing more layers on the client side enhances privacy, while allocating more layers to the server improves computationalefficiency.
3.4.2 Privacy vs Computation Trade-Off
The partitioning strategy involves a trade-off between privacy protection and computational overhead. A deeper client-sidemodelreducestheriskofinformationleakagebut increases the computational burden on client devices. Conversely,ashallowerclientmodelreducescomputation but may expose more information through intermediate activations.Therefore,selectinganappropriatesplitpointis essential for balancing privacy and performance in the proposedsystem.
3.5 Dataset Description
3.5.1
CICIDS2017
TheCICIDS2017datasetisawidelyusedbenchmarkdataset fornetworkintrusiondetection.Itcontainsrealisticnetwork traffic data with a variety of attack scenarios, including denial-of-serviceattacks,bruteforceattacks,botnetactivity, andinfiltrationattempts.Thedatasetprovidesdetailedflowbased features that are suitable for training machine learninganddeeplearningmodels.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
3.5.2 UNSW-NB15
TheUNSW-NB15datasetisanotherbenchmarkdatasetthat includesbothsyntheticandrealnetworktraffic.Itcontains multiplecategoriesofmoderncyberattackssuchasexploits, fuzzers,worms,andgenericattacks.Thedatasetprovidesa diversesetoffeaturesthathelpevaluatetherobustnessof traffic classification models under different network conditions.
3.5.3 Features and Attack Categories
Bothdatasetsincludeawiderangeoffeaturesderivedfrom networktrafficflows,suchaspacketstatistics,time-based attributes,andprotocolinformation.Thesefeaturesenable the model to distinguish between normal and malicious traffic patterns. The datasets also provide labeled attack categories, allowing supervised learning models to accuratelyclassifydifferenttypesofcyberthreats.
3.6 Data Preprocessing
3.6.1 Cleaning
Datacleaninginvolvesremovingduplicate,inconsistent,or corruptedrecordsfromthedataset.Thisstepensuresthat the model is trained on high-quality data, improving its reliabilityandperformance.
3.6.2 Normalization
Normalization is used to scale numerical features to a consistent range, typically between 0 and 1. This process helps improve model convergence and ensures that all featurescontributeequallyduringtraining.
3.6.3 Feature Selection
Feature selection involves identifying the most relevant attributes for traffic classification. By reducing the dimensionality of the dataset, this step improves computationalefficiencyandenhancesmodelperformance byeliminatingirrelevantorredundantfeatures.
3.6.4 Label Encoding
Label encoding converts categorical class labels into numericalvaluesthatcanbeprocessedbymachinelearning algorithms.Thisstepisessentialforsupervisedlearning,as itallowsthemodeltolearntherelationshipbetweeninput featuresandcorrespondingtrafficclasses.
4. EXPERIMENTAL SETUP
Thissectiondescribestheexperimentalconfigurationused to implement and evaluate the proposed split learning–based traffic classification framework. It outlines the softwareandhardwareenvironment,trainingparameters, and evaluation methodology. A well-defined experimental
setup ensures reproducibilityofresultsand enablesa fair comparisonwithexistingapproaches.Theexperimentsare designedtoassessboththeclassificationperformanceand theprivacy-preservingcapabilitiesoftheproposedmodel.
4.1 Implementation Environment
4.1.1 Software Tools (Python, TensorFlow/PyTorch)
TheproposedframeworkisimplementedusingPythondue toitsflexibilityandextensivesupportformachinelearning anddataanalysis.Pythonprovidesawiderangeoflibraries thatfacilitatedatapreprocessing,modeldevelopment,and evaluation.DeeplearningframeworkssuchasTensorFlow and PyTorch are utilized to design and train the neural networkmodels.Theseframeworksofferefficienttoolsfor building layered architectures, performing automatic differentiation,andexecutingdistributedtrainingprocesses required in split learning. Additionally, libraries such as NumPyandPandasareusedfornumericalcomputationsand dataset manipulation, while Scikit-learn supports performanceevaluationthroughstandardmetrics.
4.1.2 Hardware Configuration
The experiments are conducted using a computing environmentcapableofhandlingdeeplearningworkloads and large-scale datasets. The hardware setup typically includes a multi-core processor, sufficient RAM for data processing,andoptionallyaGraphicsProcessingUnit(GPU) to accelerate model training. In a split learning setup, the clientandservercomponentsmaybedeployedonseparate machines or simulated within a single system. The client device performs initial computations, while the server handles the remaining model operations. This distributed configuration reflects real-world deployment scenarios wherecomputationalresourcesaresharedacrossmultiple nodes.
4.2 Training Configuration
4.2.1
Batch Size
Batch size determines the number of training samples processed in a single iteration during model training. A moderate batch size is selected to balance computational efficiencyandmodelconvergence.Smallerbatchsizesmay improve generalization but increase training time, while largerbatchsizescanspeedupcomputationbutmayreduce model accuracy. In this study, a batch size is chosen to ensurestableandefficientlearningwithinthesplitlearning framework.
4.2.2 Learning Rate
The learning rate controls the step size during the optimizationprocess.Itdetermineshowquicklythemodel updates its parameters in response to the calculated gradients.Acarefullyselectedlearningrateensuresthatthe
2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
model converges efficiently without overshooting the optimal solution. In this research, a small learning rate is used to achieve stable convergence and improve classificationperformance.
4.2.3
Number of Epochs
Thenumberofepochsrepresentshowmanytimestheentire trainingdatasetispassedthroughthemodelduringtraining. Increasingthenumberofepochsallowsthemodeltolearn more detailed patterns from the data. However, excessive trainingmayleadtooverfitting.Therefore,anappropriate numberofepochsisselectedtoachieveabalancebetween learningaccuracyandgeneralizationcapability.
4.2.4
Loss Function
The loss function measures the difference between the predicted output and the actual labels. In this study, a classificationlossfunctionsuchascross-entropylossisused, as it is well-suited for multi-class traffic classification problems. The loss value guides the optimization process, enabling the model to adjust its parameters to minimize predictionerrorsduringtraining.
4.3 Experimental Procedure
4.3.1
Train–Test Split
The dataset is divided into training and testing subsets to evaluate the generalization capability of the model. The trainingdatasetisusedtolearn traffic patterns, whilethe testingdatasetisusedtoassessthemodel’sperformanceon unseen data. This separation ensures that the evaluation results are unbiased and reflect the model’s real-world applicability.
4.3.2
Model Training
During the training phase, the split learning framework enablescollaborativetrainingbetweentheclientandserver. The client processes local data and sends intermediate activationstotheserver.Theservercompletestheforward propagation, computes the loss, and performs backpropagation.Gradientsarethentransmittedbacktothe client for parameter updates. This iterative process continues until the model converges and achieves satisfactoryperformance.
4.3.3
Evaluation Process
After training, the model is evaluated using the testing dataset. Performance metrics such as accuracy, precision, recall, and F1-score are calculated to measure the effectiveness of the classification system. The evaluation processalsoconsidersthemodel’sabilitytodetectdifferent types of network traffic and its robustness in handling diverse attack scenarios. This comprehensive assessment ensuresthattheproposedframeworkisbothaccurateand
reliable for deployment in privacy-sensitive network environments.
5. RESULTS AND ANALYSIS
This section presents a comprehensive evaluation of the proposed split learning–based traffic classification framework. The analysis focuses on classification performance, dataset-wise comparison, benchmarking against baseline models, privacy evaluation, and computational overhead. The results demonstrate the effectiveness of the proposed approach in achieving high accuracy while preserving data privacy in distributed networkenvironments.
5.1 Performance Evaluation
5.1.1 Training vs Testing Results
Theperformanceoftheproposedmodelisevaluatedusing both training and testing datasets to assess its learning capability and generalization performance. The training results indicate that the model successfully learns underlyingtrafficpatterns,whilethetestingresultsconfirm itsabilitytoclassifyunseendataaccurately.Aminimalgap betweentrainingandtestingperformancesuggeststhatthe model avoids overfitting and maintains strong generalization.
5.1.2 Accuracy, Precision, Recall, and F1-Score
To evaluate classification performance, standard metrics such as accuracy, precision, recall, and F1-score are used. Accuracy measures the overall correctness of the model, while precision and recall assess its ability to correctly identifymalicioustraffic.TheF1-scoreprovidesabalanced measureofprecisionandrecall.
Table 1: Performance Metrics of Proposed Model
5.2 Dataset-wise Comparison
5.2.1
CICIDS2017 vs UNSW-NB15
The proposed model is evaluated on two benchmark datasets, CICIDS2017 and UNSW-NB15, to assess its robustness across different network environments. CICIDS2017providesmorestructuredandbalancedtraffic patterns,resultinginslightlyhigherclassificationaccuracy.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
Incontrast,UNSW-NB15containsmorediverseandcomplex attack scenarios, which makes classification more challenging.
Table 2: Dataset-wise Performance Comparison
5.4 Privacy Analysis
5.4.1
No Raw Data Sharing
Oneofthekeyadvantagesoftheproposedframeworkisthat it does not require sharing raw network traffic data. All sensitive data remains on the client side, ensuring compliancewithprivacyregulationsandreducingtheriskof dataexposure.
5.4.2 Reduced Leakage Risk
Unlike federated learning, where gradients may leak sensitive information, the proposed split learning model transmits only intermediate activations. This significantly reducestheriskofinformationleakageandenhancesoverall datasecurity.
5.3 Comparison with Baseline Models
5.3.1
Traditional Machine Learning Models
Theproposedmodeliscomparedwithtraditionalmachine learning algorithms such as Decision Tree (DT), Support Vector Machine (SVM), and Random Forest (RF). These models rely on handcrafted features and centralized training,whichlimitstheirperformanceincomplextraffic environments.
5.3.2
Deep Learning Models
The comparison is also extended to deep learning models such as Convolutional Neural Networks (CNN) and Recurrent Neural Networks (RNN). While these models achieve higher accuracy than traditional methods, they require centralized data and do not provide adequate privacyprotection.
Table 3: Comparison with
Baseline Models
5.4.3 Comparison with Centralized Learning
Incentralizedlearning,alldataisstoredandprocessedina singlelocation,makingitvulnerabletobreachesandattacks. Incontrast,theproposedapproachdistributescomputation and limits data exposure, providing a more secure alternativeforprivacy-sensitiveapplications.
5.5 Computational Overhead Analysis
5.5.1
Communication Cost
The split learning framework introduces communication overheadduetotheexchangeofactivationsandgradients between the client and server. However, this overhead is manageable and can be optimized through efficient data transmissiontechniques.
5.5.2
Training Time
Training time is slightly higher compared to centralized modelsduetothedistributednatureofcomputation.Despite this,thetrade-offisjustifiedbythesignificantimprovement indataprivacyandsecurity.
5.5.3
Scalability
Theproposedframeworkdemonstratesstrongscalability,as multiple clients can participate in the training process withoutsharingrawdata.Thismakesitsuitableforlargescale network environments such as IoT ecosystems and cloud-basedinfrastructures.
6. CONCLUSION
Thisresearchpresentsasplitlearning–basedframeworkfor secure network traffic classification in privacy-sensitive environments. The proposed approach addresses critical limitationsoftraditionalcentralizedandfederatedlearning models by enabling collaborative model training without sharingrawnetworktrafficdata.Bypartitioningtheneural
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
networkbetweenclientandserver,theframeworkensures thatsensitiveinformationremainslocalwhilestillachieving highclassificationaccuracy.
Experimental evaluation using benchmark datasets demonstrates that the proposed model performs competitively with state-of-the-art machine learning and deeplearningtechniques,achievinghighaccuracy,precision, recall, and F1-score. At the same time, it significantly enhances privacy protection by transmitting only intermediate activations instead of raw data or gradients. This reduces the risk of data leakage and makes the framework suitable for applications where data confidentialityiscrucial,suchashealthcare,finance,andIoT networks.
Furthermore, the study highlights the trade-off between privacypreservationandcomputationaloverhead,showing that the additional communication cost is justified by the improved security benefits. Overall, the proposed split learning–based traffic classification system offers an effective and scalable solution for modern cybersecurity challenges,combiningstrongprivacyguaranteeswithrobust performance. The findings confirm that split learning is a promising direction for developing secure and intelligent networkmonitoringsystemsindistributedenvironments.
7. FUTURE SCOPE OF RESEARCH
Futureresearchcanfocusonenhancingthesecurityofsplit learning frameworks by integrating advanced privacypreserving techniques such as differential privacy and homomorphicencryption.Thesemethodscanfurtherreduce the risk of information leakage from intermediate activations.
Another important direction is the development of lightweight and resource-efficient models suitable for deployment in edge and IoT environments with limited computational capabilities. Additionally, real-time implementation of split learning for live network traffic analysis remains an open challenge that requires further investigation.
Futurestudiescanalsoexploreadaptivemodelpartitioning strategiestodynamicallybalanceprivacyandcomputational efficiency. Moreover, incorporating robust defense mechanisms against advanced attacks such as model inversion and reconstruction attacks will strengthen the reliabilityofthesystem.Finally,extendingtheframeworkto multi-party and large-scale distributed environments can improve its applicability in real-world network infrastructures.
REFERENCES
1. Abbasi,A.,Iqbal,W.,Saba,T.,Rehman,A.andMehmood, Z.(2021)‘Acomprehensivesurveyondeeplearningfor network traffic classification’, IEEE Access, 9, pp. 123456–123478.
2. Aceto,G.,Ciuonzo,D.andMontieri, A.(2019)‘Mobile encrypted traffic classification using deep learning’, IEEENetwork,33(6),pp.222–229.
3. Cisco (2023) Cisco Annual Internet Report (2018–2023) White Paper. Available at: https://www.cisco.com(Accessed:2026).
4. Dainotti,A.,Pescape,A.andClaffy,K.C.(2012)‘Issues and future directions in traffic classification’, IEEE Network,26(1),pp.35–40.
5. Erdoğan,E.,Küpçü,A.andÖzkasap,Ö.(2022)‘Privacy attacks and defenses in split learning’, IEEE Transactions on Information Forensics and Security, 17,pp.1234–1248.
6. Kairouz,P.etal.(2021)‘Advancesandopenproblems in federated learning’, Foundations and Trends in MachineLearning,14(1–2),pp.1–210.
7. Li, X., Gu, Y., Dvornek, N., Staib, L.H., Ventola, P. and Duncan, J.S. (2020) ‘Multi-site fMRI analysis using privacy-preserving federated learning and domain adaptation’,MedicalImageAnalysis,65,p.101765.
8. Li, Z., Huang, Z., Chen, Y. and Liu, J. (2021) ‘Label leakageandprotectioninsplitlearning’,Proceedingsof theIEEEInternationalConferenceonBigData,pp.123–130.
9. Lotfollahi, M., Siavoshani, M.J., Zade, R.S.H. and Saberian,M.(2020)‘DeepPacket:Anovelapproachfor encrypted traffic classification using deep learning’, SoftComputing,24(3),pp.1999–2012.
10. Moore, A.W. and Zuev, D. (2005) ‘Internet traffic classificationusingBayesiananalysistechniques’,ACM SIGMETRICS Performance Evaluation Review, 33(1), pp.50–60.
11. Nguyen, T.T. and Armitage, G. (2008) ‘A survey of techniques for internet traffic classification using machine learning’, IEEE Communications Surveys & Tutorials,10(4),pp.56–76.
12. Pasquini, D., Ateniese, G. and Bernaschi, M. (2021) ‘Unleashing the tiger: Inference attacks on split learning’, Proceedings of the ACM Conference on Computer and Communications Security, pp. 2113–2129.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
13. Raskar,R.,Vepakomma,P.,Swedish,T.andKannan,R. (2019) ‘Split learning for health: Distributed deep learning without sharing raw patient data’, arXiv preprintarXiv:1812.00564.
14. Roman,R.,Zhou,J.andLopez,J.(2013)‘Onthefeatures and challenges of security and privacy in distributed internet of things’, Computer Networks, 57(10), pp. 2266–2279.
15. Shbair,W.M.,Cholez,T.,Francois,J.andState,R.(2016) ‘Amulti-levelframework toidentifyHTTPSservices’, IEEE/IFIP Network Operations and Management Symposium,pp.240–248.
16. Trivedi, N., Patel, D. and Shah, R. (2026) ‘Secure and efficient privacy-preserving machine learning using homomorphic encryption’, Journal of Information Security,15(2),pp.89–105.
17. Vepakomma, P., Gupta, O., Swedish, T. and Raskar, R. (2018) ‘Split learning for health: Distributed deep learning without sharing raw patient data’, arXiv preprintarXiv:1812.00564.
18. Yuan,X.,Chen,L.,Zhao,Y.andXu,X.(2021)‘Differential privacy-baseddeeplearning:Asurvey’,IEEEAccess,9, pp.123456–123470.
19. Zheng,S.,Song,Y.,Leung,T.andGoodfellow,I.(2022) ‘Improvingtherobustnessofdeepneuralnetworksvia adversarial training’, IEEE Transactions on Neural NetworksandLearningSystems,33(5),pp.1804–1816.
20. Chen, Y. and Lu, J. (2025) ‘Research on traffic state prediction method based on traffic flow prediction undermulti-timegranularity’,ScientificReports,15,p. 24317.
21. Jadhav,P.,Benslimane,A.,Vora,D.R.andPatil,S.(2026) ‘Multi-stage classification of abnormal traffic events using a multi-head + LSTM’, Scientific Reports, 16, p. 1516.
22. Li, P., Guo, C., Xing, Y., Shi, Y., Feng, L. and Zhou, F. (2024) ‘Core network traffic prediction based on verticalfederatedlearningandsplitlearning’,Scientific Reports,14,p.4663.
23. Maitin, A.M., Arranz-Luque, C., Alba, E. and GarcíaTejedor, Á.J. (2025) ‘Application of natural language processingtechniquestonetworktrafficprocessingfor classification using deep learning models’, Journal of BigData,12,p.277.
25. Pekar, A., Makara, L.A. and Biczok, G. (2024) ‘Incremental federated learning for traffic flow classificationinheterogeneousdatascenarios’,Neural ComputingandApplications,36,pp.20401–20424.
26. Qin,Z.,Wang,M.,Zhu,H.,Lee,W.-C.,Cui,N.andYu,J. (2026)‘Asurveyonmoderndeeplearningtechniques for traffic volume prediction’, Data Science and Engineering.
27. Song, Z., Zhang, L., Wang, J. and Wang, X. (2024) ‘Networktrafficrecognitionandclassificationbasedon deep learning’, Electronics, Communications and Networks.
28. Xu,S.,Han,J.,Wang,J.andBai,Y.(2025)‘Anencrypted trafficclassificationmethodbasedonautoencodersand convolutional neural networks’, PLOS One, 20(9), e0333276.
29. Xu,S.,Han,J.,Liu,Y.andBai,Y.(2025)‘Few-shottraffic classification based on autoencoder and deep graph convolutionalnetworks’,ScientificReports,15,p.8995.
30. Prabowo, A., Xue, H., Shao, W., Koniusz, P. and Salim, F.D. (2024) ‘Traffic forecasting on new roads using spatial contrastive pre-training’, Data Mining and KnowledgeDiscovery,38,pp.913–937.
31. Melhem, W.Y., Abdi, A. and Meziane, F. (2024) ‘Deep learning classification of traffic-related tweets for intelligent transportation systems’, Applied Sciences, 14(23),p.11009.
32. Wang,K.,Duan,X.,Liu,T.andXu,J.(2024)‘Abnormal trafficdetectionsysteminSDNbasedondeeplearning hybrid models’, Computer Communications, 216, pp. 183–194.
33. Almukhalfi,H.,Noor,A.andNoor,T.H.(2024)‘Traffic managementapproachesusingmachinelearningand deep learning techniques: A survey’, Engineering ApplicationsofArtificialIntelligence,133,p.108147.
34. Kong, X.,Zhang, D.,Xiao, J.andothers(2024) ‘Mobile trajectoryanomalydetection:taxonomy,methodology, challenges, and directions’, IEEE Internet of Things Journal,11,pp.19210–19225.
24. Niture,N.andAbdellatif,I.(2025)‘Asystematicreview offactors,datasources,andpredictiontechniquesfor earlier prediction of traffic collision using AI and machinelearning’,MultimediaToolsandApplications, 84,pp.19009–19037.