Abstract: Abstract: To address the issue of insufficient representation capability in malicious encrypted traffic detection models， a malicious encrypted traffic detection method based on contrastive learning is proposed， with the goal of enhancing the model’s representation ability and thereby improving the detection accuracy of malicious encrypted traffic. This method diverges from traditional approaches that directly extract features from traffic data， focusing instead on learning the intrinsic representations of the data prior to feature extraction. Specifically， local and global features of encrypted traffic are extracted using a multi-scale mechanism to capture key information at different scales. Then， in the metric space of contrastive learning， the distance between encrypted traffic and the correct classification label is minimized， while the distance from the incorrect classification label is maximized by optimizing the objective function， enabling the model to better distinguish between malicious and normal encrypted traffic. After training， the model captures more discriminative features of encrypted traffic， ultimately improving detection accuracy. The experimental dataset is composed of sampling from multiple public datasets including UNSW NS 2019， CICIDS-2017， CIC-AndMal 2017， Malware Capture Facility Project Dataset， and CICIDS-2012. The results show that the method achieves 97.59% detection accuracy， exceeding comparative models， with 3.16 percentage points increase over the random forest benchmark. Furthermore， the interpretability and detection rate of the method are also improved. 

Key words: Key words: encrypted traffic, malicious traffic, deep learning, contrastive learning, multi-scale features