🤖 AI Summary
Traditional traffic analysis has become ineffective due to the widespread adoption of encryption and privacy-enhancing technologies. Existing machine learning approaches often rely on protocol-specific features, require large amounts of labeled data, and exhibit poor generalization across domains. To address these limitations, this work proposes the first purely metadata-driven, protocol-agnostic framework for encrypted traffic analysis. By modeling network flows as multivariate time series and integrating meta-learning, embedding optimization, and self-attention mechanisms, the framework enables rapid cross-scenario adaptation under few-shot conditions. Evaluated across nine public datasets on tasks including application identification, VPN traffic classification, IoT device fingerprinting, and attack detection, the method consistently outperforms state-of-the-art approaches, demonstrating strong generality, robustness, and practical utility.
📝 Abstract
Traditional traffic analysis is being fundamentally challenged by the rapid adoption of encryption, tunnelling, and privacy-preserving protocols, which increasingly obscure packet payloads and limit the usefulness of Deep Packet Inspection (DPI). Although machine learning has advanced encrypted traffic analysis, existing approaches often remain tied to protocol-specific header features, depend on large labelled datasets, and degrade when deployed across heterogeneous network environments. We present GETA, a protocol-agnostic framework for encrypted traffic analysis that models network flows as multivariate time series using only traffic metadata, thereby avoiding reliance on packet payloads or header semantics. GETA combines meta-learning, embedding refinement, and self-attention to support few-shot adaptation to previously unseen domains with minimal labelled data. Across nine public datasets spanning application identification, VPN traffic classification, IoT device fingerprinting, and attack detection, GETA consistently outperforms state-of-the-art baselines. These results show that GETA offers a practical and generalisable foundation for robust traffic analysis in modern encrypted networks.