NFTracker: Fine-Grained NFT Behavior Traffic Identification Over Encrypted Tunnel

Abstract

Non-Fungible Tokens (NFTs) have completely changed digital ownership and the decentralized economy. However, their anonymity and encrypted communication, conducted over encrypted tunnels, pose a significant obstacle to regulating illegal activities. Despite advances in encrypted traffic analysis, fine-grained identification of NFT behaviors over encrypted tunnels faces two critical challenges: 1) inexact segmentation of continuous behavioral traffic, and 2) feature homogeneity due to encryption-induced pattern obfuscation. In this paper, we propose NFTracker, a novel framework to identify fine-grained NFT behavioral traffic over encrypted tunnels. We design a traffic segmentation method to isolate behavioral units by leveraging traffic bursts and distribution discrepancies. To combat feature homogeneity, we introduce a sliding-window-based spatio-temporal feature extraction mechanism that captures localized action fingerprints. Furthermore, we utilize a hybrid CNN-Transformer model to integrate spatial patterns and temporal dependencies for robust behavior identification. We evaluate NFTracker on real-world datasets covering five NFT behaviors (browsing, wallet login, purchasing, selling, and minting). Experimental results demonstrate that NFTracker achieves an average F1-score of 0.9212 on identifying NFT behavioral traffic, outperforming state-of-the-art methods in encrypted tunnel scenarios.