CTU-Fusion: Utility-Guided Flow–Topology Fusion for Encrypted Traffic Classification

Strong encrypted traffic classifiers remain constrained by the information within an individual flow. Historical and relational context can provide complementary evidence, but inappropriate fusion can corrupt correct predictions. We propose CTU-Fusion, a utility-guided Flow–Topology framework that separates primary prediction from auxiliary residual correction, estimates the sample-specific benefit and harm of each correction, and selectively controls its influence. Across three traffic-classification settings, CTU-Fusion improves Macro-F1 over the strongest evaluated baseline by 1.12–4.26%. Mapping-aware audits distinguish useful IoT history, negligible CICIDS topology, and severe negative transfer from unreliable USTC timestamps. Component, routing, and robustness studies separate Flow capability, complementary information, and realized fusion gains. These results show that relational evidence should influence a prediction only when its estimated utility is sufficient.