Attack classification of network traffic is valuable for many security solutions as it points out a clear direction for attack responses. Nowadays, most network traffic is encrypted, which protects user privacy but hides attack traces, further hindering identifying attacks to inspect traffic packages. Machine Learning(ML) methods are widely applied to attack classification on encrypted traffic owing to no need for manual analysis. However, existing studies only concentrate on basic statistical features, which are easily modified, and cannot obtain the crucial attack behaviors hiding in the encrypted traffic. In this paper, we propose an attack classification method, ACG. We create attack graphs to depict interaction behaviors of attack-victim hosts from network traffic containing crucial attack behaviors. Besides, we divide a specific duration for each attack to precisely elaborate attack graphs, where temporal, statistical, and aggregate features are extracted to portray attack behaviors. Finally, we utilize Graph Neural Networks (GNNs) to mine and grasp the crucial behavior patterns from attack graphs to generate fingerprints and classify attacks. Extensive experiments are conducted on three datasets to verify our method. It achieves a precision of 99% in attack classification on encrypted traffic, an average higher than other ML methods of 50%.