1 Introduction↩︎

The widespread adoption of encryption protocols such as TLS, QUIC, and IPsec enhances the confidentiality and integrity of network communications but limits the effectiveness of traditional monitoring methods, such as deep packet inspection (DPI), that rely on payload inspection. Consequently, conventional traffic analysis struggles to characterize and classify encrypted flows. In contrast, machine learning (ML) approaches exploit observable flow features such as packet sizes, inter-arrival times, and directions to analyze traffic without accessing payloads [1], [2], enabling scalable and privacy-preserving visibility into encrypted networks.

Encrypted traffic analysis (ETA) has emerged as a key paradigm for understanding network behavior and detecting malicious activity through inference from traffic patterns, flow dynamics, and statistical characteristics  [3]. With over 90% of web traffic now encrypted [4], the ability to analyze traffic flows without inspecting packet contents has become essential for both research and operational network security.

Advances in ML and deep learning (DL) have enhanced ETA by enabling automated extraction of complex, non-linear patterns in encrypted traffic, improving classification and behavioral modeling Yang2024?. However, several approaches still rely on packet header information [5], [6], a major limitation in scenarios involving VPNs, tunnels, or privacy-preserving networks where headers are minimal, encrypted, or entirely obfuscated, leading to degraded accuracy and robustness across diverse environments [7].

A key challenge for ML-based ETA is its reliance on large labeled datasets. While supervised learning performs well in controlled settings, it demands extensive data collection and manual labeling, limiting scalability in real-world deployments [8]. Changes in traffic patterns, device usage, or encryption protocols often demand retraining, which is time-consuming and resource-intensive. This reliance on static datasets also weakens generalizability. Models trained in one environment frequently fail in another because they overfit to environment-specific characteristics instead of learning robust, transferable traffic patterns [9], [10]. Recent studies show sharp performance drops under domain shifts [6], [7], highlighting the brittleness of current ETA solutions.

To address these challenges, we present GETA: Generalized Encrypted Traffic Analysis, a protocol-agnostic framework that models encrypted traffic as multivariate time series using only consistently observable traffic metadata. Rather than relying on packet payloads or header semantics, GETA jointly models packet size, inter-arrival time, and packet direction as correlated temporal signals. This design enables GETA to capture richer flow-level dependencies while remaining applicable across diverse encrypted and tunneled network environments. To further improve generalization, GETA integrates meta-learning with embedding refinement and self-attention, allowing the model to adapt to unseen network domains using only a small number of labelled examples. This makes GETA particularly suitable for realistic deployments where traffic distributions evolve and labelled data are scarce. This work makes the following contributions:

• A protocol-agnostic representation for encrypted traffic analysis. We introduce a metadata-driven multivariate time-series representation for ETA that avoids reliance on packet payloads, protocol headers, or application-specific semantics. By jointly modeling packet size, inter-arrival time, and packet direction, GETA captures temporal and cross-feature dependencies that are often missed by univariate or header-dependent approaches.

• Few-shot generalization through meta-learning and embedding refinement. We present a meta-learning-based methodology for ETA under diverse network conditions. We propose a novel modification to time-series models to handle multivariate traffic metadata. GETAincorporates a meta-learning framework that enables rapid adaptation using only a few labeled samples. A key innovation is the embedding enhancement module, which refines the initial traffic embeddings to capture more nuanced representations. In addition, we apply self-attention over the support set to inject task-specific context into the embeddings, enabling the model to adapt more effectively to each classification task. Together, these components produce more discriminative and generalizable representations, boosting performance across diverse network conditions without requiring task-specific retraining.

• Strong generalization and superior performance across diverse domains and tasks: GETA demonstrates robust few-shot performance under domain shifts, reflecting realistic deployment scenarios with limited labeled data and evolving network conditions. We meta-train on one dataset and evaluate on a different dataset across nine public datasets, spanning application identification (including VPN traffic), IoT device classification, and attack detection. GETA consistently outperforms existing baselines compared to the next-best model in diverse tasks.

The remainder of the paper is organized as follows: Section II discusses related work, Section III describes the proposed methodology, Section IV presents evaluation results across multiple datasets, and Section V concludes with a discussion.

2 Related Work↩︎

We organize the related work into three areas aligned with our methodology. First, we review deep learning methods for ETA, followed by Few-Shot/Zero-Shot Learning approaches that address data scarcity. Next, we examine Time Series Modeling, which motivates our use of structured traffic metadata.

2.1 Encrypted Traffic Analysis (ETA)↩︎

ETA seeks to infer application, device, or behavioral information from encrypted network flows without accessing payloads. Recent transformer- and LLM-inspired methods operate directly on raw packet bytes  [6], [11], [12]. For instance, ET-BERT  [6] applies a BERT-style model to Ethernet packet bytes, achieving high accuracy but requiring extensive pretraining and showing poor generalization in constrained settings such as VPNs or non-TCP traffic  [7]. These limitations stem from a reliance on byte-level patterns and plaintext headers, which may be obfuscated or unavailable in practice. Furthermore,  [13] shows that byte-based models frequently overfit to pseudorandom fields such as Sequence/Ack numbers, learning spurious correlations rather than true traffic semantics. Metadata-based ETA methods, which predate byte-based deep learning, instead rely on flow-level features such as packet size, direction, and timing  [14], [15]. While these methods offer greater interpretability and robustness to encryption or protocol variation, they traditionally require large labeled datasets and remain domain-specific [7], [16], [17]. As byte-based methods remain vulnerable to obfuscation and domain shifts, revisiting metadata-based analysis with modern learning paradigms is essential for building generalizable and data-efficient ETA systems.

2.2 Few-Shot/Zero-Shot Learning for ETA↩︎

Few-shot learning addresses data scarcity in traffic classification amid rapid shifts in device types and application behaviors. Zhao et al. [18] use the first few bytes of initial packets for IoT traffic classification, achieving good results in TCP/UDP settings, but as our RQ3 experiments show, performance degrades sharply when header information is minimal. Others [19], [20] propose few-shot learning methods that use directed packet-length sequences with Model-Agnostic Meta-Learning (MAML) [21], improving adaptation and reducing dependence on raw bytes, but capture only packet size and direction while neglecting temporal structure. More recently, ZEST [22] explores zero-shot IoT device classification to identify unseen devices, showing promise but remaining limited to one dataset and requiring large labeled data for seen classes.

In contrast, our work integrates few-shot learning with a transformer-based multi-variate time-series model, enabling robust generalization to unseen traffic classes with minimal labeled data and strong performance across heterogeneous classification tasks such as application, device, and attack identification.

2.3 Time Series Modeling for Network Traffic↩︎

Several ETA methods model encrypted traffic as a time series for classification [1], [2], [14], but they often rely on single-variable representations (e.g., packet size) and require manually crafted features. This process is time-consuming, error-prone, and often fails to capture complex temporal dependencies among flow attributes  [1], [2], [6].

Time series models address this by treating flows as sequences of structured metadata (e.g., packet size, inter-arrival time, direction), providing invariance to encryption protocols and payload content. MetaRockETC [20] adopts a related approach using MultiRocket [23]. Recent advances in transformer-based architectures have further improved time-series analysis  [24]–[27]. Notably, UniTS  [27] presents a unified framework that performs well across diverse tasks and supports multivariate time series inputs. However, UniTS is not designed for few-shot learning and lacks mechanisms for rapid adaptation or cross-domain generalization.

Our method extends UniTS beyond general-purpose time-series modeling by incorporating meta-learning for few-shot ETA. We tailor the architecture to network-specific multivariate inputs and evaluate it across heterogeneous downstream tasks, demonstrating adaptability for real-world security deployments.

3 Methodology↩︎

3.1 Overview and Notation↩︎

GETAleverages meta-learning to advance ETA under few-shot learning settings, enabling adaptation to downstream tasks with minimal labeled data. Its objective is to learn an embedding function and a classification mechanism that, after a few inner-loop updates on a small support set, generalize effectively to query samples from the same task. Our approach, shown in Figure 1, consists of five stages: traffic representation, embedding generation, embedding enhancement, self-attention-based prototype creation, and meta-learning optimization. Each stage supports this objective: traffic representation and base embeddings capture task-agnostic features; the embedding enhancer and prototype refinement improve discriminability in few-shot decision boundaries; and meta-learning optimises initialisation for fast adaptation.

Table 1 provides a complete reference for all notation and dimensions used throughout this section.

3.2 Traffic Representation↩︎

We represent network traffic as a multivariate time series to capture the joint temporal dynamics of packet size, direction, and timing. This protocol-agnostic representation relies on observable features that remain available under encryption and VPNs. We use four variables: packet size (\(P_t\)), incoming direction (\(ID_t\)), outgoing direction (\(OD_t\)), and inter-arrival time (\(IAT_t\)). The traffic sequence at time step \(t\) is: \[X_t = (P_t, ID_t, OD_t, IAT_t), X = \{X_1, X_2, \dots, X_T\}\]

Each tuple represents the four features at time step \(t\), where \(X\) is the input sequence of length \(T\). For example, a traffic sequence of length \(T=3\) might look like: \(X = \{(512, -1, 0, 0.0),\;(128, 0, 1, 0.1),\;(64, -1, 0, 0.8)\}\).

We represent traffic direction using two binary indicators \((ID_t, OD_t)\) rather than a single binary variable. Empirically, this increased classification accuracy by up to 1% compared to using a single variable, likely due to clearer directional semantics, improved gradient flow, and reduced feature ambiguity during training.

3.3 Base Model Embedding Generation↩︎

To extract meaningful representations from the multivariate traffic sequence, we adopt a modified transformer-based architecture based on UniTS [27], shown in Fig 1 part(i). UniTS is chosen for its ability to model multivariate time-series data. The input tensor \(X \in \mathbb{R}^{s \times v \times d}\) (see Table 1 for dimensions) undergoes variable-wise multi-head self-attention to capture feature interactions, with attention weights computed between variables and averaged across the time dimension for efficiency. The variable-attentive representations are modulated by learnable gating and passed through a Dynamic Feed Forward Network with temporal convolution to capture local sequential patterns. A learned task token then queries all feature tokens via cross-attention (scaled dot-product, task token as query), followed by MLP refinement, producing the final embedding \(E \in \mathbb{R}^{d_E}\): \[\begin{align} E = \text{\textit{MLP}}(&\text{\textit{CrossAttention}}(\text{\textit{task token}}, \nonumber \\ &\text{\textit{feature tokens}}, \text{\textit{feature tokens}})) \end{align}\]

3.4 Embedding Enhancer Module↩︎

We introduce an embedding enhancement module to refine embeddings before prototype computation and classification. This is motivated by the need to reduce noise and improve discriminability in the embedding space when only a few support samples per class are available. The module stabilizes gradients and keeps embeddings well-scaled via layer normalization, a linear projection with ReLU, and a final layer norm. Given input embedding \(E \in \mathbb{R}^{d_E}\), the enhanced embedding \(E'\) (same dimension) is: \[\begin{align} E' &= \text{LayerNorm}(\text{ReLU}(W E + b)),\\ &\quad W \in \mathbb{R}^{d_E \times d_E},\; b \in \mathbb{R}^{d_E}. \end{align}\] In our implementation, we additionally apply dropout and an optional feature-wise scale and bias (calibration) for stability. \(E'_k\) and \(E'_q\) denote enhanced embeddings of support samples for class \(k\) and of the query sample, respectively.

3.5 Prototype Based Loss↩︎

Based on  [28], this stage aims to form class representatives that are robust to support-set noise and transfer across tasks. For each class \(k\), we first refine the support embeddings \(E'_k\) with multi-head self-attention (scaled dot-product, 4 heads): the same set of vectors is used as query, key, and value, yielding refined embeddings \(A_k\). The class prototype is their mean. Formally, for class \(k\) with support set \(D^s_k\): \[\begin{align} A_k &= \text{MultiHeadSelfAttn}(E'_k, E'_k, E'_k) \in \mathbb{R}^{|D^s_k| \times d_E},\\ C_k &= \frac{1}{|D^s_k|} \sum_{(x_i, y_i) \in D^s_k} A_i \in \mathbb{R}^{d_E}. \end{align}\]

ProtoAdaptation is a two-layer MLP that maps prototypes to a space better suited for cross-task comparison: \(C'_k = \text{ProtoAdaptation}(C_k)\) with \(\text{ProtoAdaptation}(z) = W_2 \,\text{ReLU}(W_1 z + b_1) + b_2\), where \(W_1, W_2 \in \mathbb{R}^{d_E \times d_E}\) and \(b_1, b_2 \in \mathbb{R}^{d_E}\) are learnable. For the query sample \(x_q\) with enhanced embedding \(E'_q\), we compute temperature-scaled squared Euclidean distances: \[d_k = \frac{|E'_q - C'_k|_2^2}{\tau}\] where \(\tau\) is a learnable temperature parameter. Classification probabilities are obtained via softmax over negative distances: \[p(y = k \mid x_q) = \frac{e^{-d_k}}{\sum_j e^{-d_j}}\] The prototype loss is the cross-entropy between predicted and ground-truth labels, serving as one branch of our dual-pathway loss function (Section 3.6).

3.6 Combined Loss Function↩︎

To combine the strengths of prototype-based learning and conventional classification, we use a dual-pathway approach with a combined loss function. This provides richer gradient signals during adaptation while retaining a simple prototype-based decision rule at test time: \[\small \mathcal{L}_{combined} = (1 - \lambda) \cdot \mathcal{L}_{proto} + \frac{\lambda}{2} \cdot (\mathcal{L}_{cls\_query} + \mathcal{L}_{cls\_support}) \label{eq:combined95loss}\tag{1}\]

where \(\lambda\) is a weighting hyperparameter that balances both pathways. The prototypical network loss \(\mathcal{L}_{proto}\) enforces a well-structured embedding space with same-class examples clustered together. The classification losses \(\mathcal{L}_{cls\_query}\) and \(\mathcal{L}_{cls\_support}\) ensure that these embeddings remain linearly separated through direct mapping. This dual formulation provides rich gradient information and acts as an implicit regularizer, preventing overfitting to a single pathway and fostering more robust, generalizable features.

We employ Model-Agnostic Meta-Learning (MAML) to optimize initialization parameters \(\theta\) for rapid adaptation to new tasks (Algorithm 2). This is motivated by the objective of finding an initialization from which a few gradient steps on the support set yield good query-set performance. For each task \(\mathcal{T}_i\), we perform inner-loop adaptation on the support set: \[\theta'_i = \theta - \alpha \nabla_\theta \mathcal{L}(D^s_{T_i}, f_\theta)\]

The meta-update aggregates gradients across tasks using the query sets: \[\theta \leftarrow \theta - \beta \sum_{i} \nabla_\theta \mathcal{L}(D^q_{T_i}, f_{\theta'_i})\] where \(\alpha\) is the inner-loop (task) learning rate and \(\beta\) is the meta (outer) learning rate.

We use \(N_{adapt}=3\) inner-loop adaptation steps during meta-training and \(20\) at evaluation. On the first step, the \(\mathcal{L}_{combined}\) is optimised, and on subsequent steps, only \(\mathcal{L}_{proto}\). Training settings: \(\alpha=0.001\), \(\beta=0.0001\), \(\lambda=0.5\); patch length and stride 4; encoder depth 3; dropout 0.3 and batch size 32.

3.7 Progressive Fine-Tuning Strategy↩︎

After meta-training, we fine-tune on downstream tasks (e.g., 5-way 5-shot) using a progressive adaptation strategy:

1. Initial Comprehensive Adaptation: Optimize the combined loss function, incorporating both prototypical and classification losses for rich gradient information.

2. Subsequent Focused Adaptation: Use only prototypical loss to improve efficiency and reduce overfitting to the small support set.

3. Final Evaluation: Assess performance on the query set using prototype-based classification, ensuring robust feature learning through the learned prototypes.

This strategy enables efficient knowledge transfer while remaining robust to limited labelled data, making it well-suited to real-world ETA scenarios.

3.8 Reproducibility↩︎

All hyperparameters and dimensional settings are summarized in Table 1; evaluation protocols are specified in Section 4. Source code and a self-contained reproducibility bundle are available at [29].

4 Evaluation↩︎

In this section, we evaluate GETA’s performance in various ETA scenarios and investigate its generalization capabilities under limited labeled data constraints. Our experiments are designed to answer the following research questions:

• RQ1: How well does GETAgeneralize across heterogeneous datasets and network environments, including device, application, and attack classification tasks?

• RQ2: How robust is GETAunder diverse N-way K-shot learning settings?

• RQ3: Can GETA’s metadata-based approach maintain strong performance in VPN-encrypted environments where header information is minimal or unavailable?

• RQ4: How does each main component of GETAcontribute to overall few-shot classification performance?

4.1 Datasets and Evaluation Methodology↩︎

We evaluate GETAon nine publicly available datasets across three domains: Application Identification, , and Attack Identification. All datasets are transformed into a multivariate time-series format. To ensure comparability across tasks and domains, we normalize the number of samples per class during task construction and discard classes with insufficient data. Importantly, each dataset is used for meta-training or evaluation, but never both, ensuring a strict assessment of generalization.

Abbreviations: ANV – Appsniffer (No-VPN), ASV – Appsniffer (SuperVPN), ANVn – Appsniffer (NordVPN), ATV – Appsniffer (TurboVPN), ASh – Appsniffer (Surfshark), UIoT – UNSW-IoT, AIoT – Aalto-IoT, CIC17 – CIC-IDS 2017, ToN

– ToN-IoT. These abbreviations will be used when referring to datasets in the plots.

Application Identification Datasets: To test GETA’s performance on application classification, we use five datasets derived from the Appsniffer suite [7]. Each dataset includes encrypted traffic from the same set of 150 Android mobile applications, captured under different network configurations: four commercial VPN services (SuperVPN, NordVPN, TurboVPN, Surfshark) and a No-VPN scenario. Each dataset consists of 7,500 samples (50 flows per class).

The VPN datasets encompass diverse encryption and tunneling protocols, including PPTP with RC4-based MPPE [34], [35], IKEv2/IPsec with ESP [36], [37], OpenVPN, and WireGuard [38]. Each employs distinct key-exchange and encapsulation mechanisms, resulting in heterogeneous structural and temporal traffic characteristics. This diversity provides a strong basis for evaluating GETA’s ability to generalize across different encryption and tunneling conditions.

Device Identification Datasets: For IoT device classification, we use the UNSW-IoT and Aalto-IoT datasets, both of which contain encrypted traffic from smart home and mobile devices. UNSW-IoT [30] includes traffic from 27 device types, such as smart speakers, plugs, and hubs, with highly imbalanced class distributions; some devices have as few as a single sample. We retain only those with sufficient data, resulting in 20 device classes for evaluation. Aalto-IoT [31] includes traffic from 28 IoT devices, with more uniform sampling across classes (roughly 20 samples per device), ensuring balanced evaluation.

Attack Detection Datasets: To evaluate encrypted traffic classification in security scenarios, we use the CIC-IDS 2017 [32] and TON-IoT [33] datasets. CIC-IDS 2017 [32] includes both benign and malicious traffic, covering various attack types including port scanning, DDoS, and brute-force attacks. While heavily imbalanced, it allows evaluation of the robustness of few-shot learning in realistic intrusion-detection scenarios. TON-IoT [33] offers balanced samples across nine attack classes, each with 12 flows. The compact size and class diversity make it ideal for evaluating few-shot classification in constrained settings.

Baseline Models: We compare GETAagainst four few-shot ETA baselines: MetaMRE [19], RBRN [39], UMVD-FSL [5], and MeTaRocket [20]. MetaMRE,MeTaRocket and RBRN use traffic metadata representations, UMVD-FSL operates on raw traffic flow bytes, and MeTaRocket likewise targets few-shot adaptation from sequence features. Evaluating GETAagainst large-scale fully supervised models would be inappropriate, as such methods fall outside the scope of few-shot learning and do not address the data-scarcity challenges that GETA targets.

Evaluation Methodology: We evaluate all methods under a unified few-shot meta-learning protocol and report macro-F1 as the primary metric. For each scenario, we construct \(N\)-way, \(K\)-shot episodes with a disjoint query set, resampling support/query examples per episode, and preventing sample overlap within each episode. Intra-domain, cross-domain, and VPN settings follow the scenario definitions in Section 4, with strict train/test dataset separation and identical transfer directions across methods. Unless otherwise stated, each scenario is evaluated on \(n_{\mathrm{ep}}{=}128\) meta-test episodes. For episode \(i\), macro-F1 is computed as \[\begin{align} \mathrm{F1}_{\mathrm{macro}}^{(i)} &= \frac{1}{C}\sum_{c=1}^{C} \frac{2\,\mathrm{Precision}_c^{(i)}\,\mathrm{Recall}_c^{(i)}}{\mathrm{Precision}_c^{(i)}+\mathrm{Recall}_c^{(i)}+\epsilon}, \\ \overline{\mathrm{F1}}_{\mathrm{macro}}^{(r)} &= \frac{1}{n_{\mathrm{ep}}}\sum_{i=1}^{n_{\mathrm{ep}}}\mathrm{F1}_{\mathrm{macro}}^{(i,r)}, \end{align}\] where \(C\) is the number of classes per episode, superscript \((r)\) indexes an independent training run with its own random seed, and \(\epsilon\) is a small constant for numerical stability. We repeat the full protocol for \(R=5\) seeds and report the grand mean \(\overline{\mathrm{F1}}=\frac{1}{R}\sum_{r=1}^{R}\overline{\mathrm{F1}}_{\mathrm{macro}}^{(r)}\) with two-sided 95% confidence intervals computed with Student’s \(t\) on these run-level aggregates, \[\begin{align} \overline{\mathrm{F1}} \pm t_{0.975,\,R-1}\cdot \frac{s_{\mathrm{seed}}}{\sqrt{R}}, \end{align}\] where \(s_{\mathrm{seed}}\) is the sample standard deviation of the \(R\) values \(\overline{\mathrm{F1}}_{\mathrm{macro}}^{(r)}\) (each already averaged over the \(n_{\mathrm{ep}}\) episodes at the checkpoint chosen for run \(r\)). The same episode construction, \(n_{\mathrm{ep}}\), checkpoint rule, and seed-level \(t\) interval are used for GETA and all baselines (MetaRocket, MetaMRE, RBRN, and UMVD) whenever multi-seed reruns are reported, so differences in performance reflect model behavior rather than protocol mismatch. During meta-training, we select checkpoints by maximizing a running average of meta-test accuracy over the three most recent evaluation intervals, with each evaluation using the \(n_{\mathrm{ep}}\) meta-test episodes defined above. Overall, we keep scenario definitions, \(N/K\) settings, episode budgets, and metrics consistent across methods.

4.2 GETA’s Effectiveness Across RQs↩︎

We now discuss the results for each research question, showing that GETA provides a robust and effective solution across all evaluation scenarios.

RQ1: Generalization Across Classification Tasks

A core challenge in encrypted traffic classification is achieving generalization beyond training domains. To evaluate this, we meta-train GETAon one dataset and test it on distinct datasets under two settings:

Intra-domain generalization: Training and testing occur within the same task (e.g., application identification) but across different datasets or traffic conditions, such as VPN vs.non-VPN. This tests robustness to realistic variations within a domain.

Cross-domain generalization: Training is performed on one task (e.g., IoT device identification) and evaluation on another (e.g., application or attack classification), assessing whether GETAlearns transferable representations that remain effective for unseen domains with limited labeled data.

Experimental Setup: We evaluate intra- and cross-domain generalization on six public datasets spanning three domains: application identification, IoT device identification, and attack detection (two per domain). All experiments follow a 2-way 5-shot setup. For intra-domain generalization, GETAis trained and tested on the same task type but under different conditions (e.g., training on VPN traffic and testing on No-VPN traffic). For cross-domain generalization, the model is trained on one domain (e.g., device identification) and evaluated on another (e.g., application or attack classification) to assess transferability across task semantics.

Results: Figures 3 and 4 show that GETAconsistently outperforms all baselines in both settings. Intra-domain results confirm strong robustness to traffic variations, for instance, training on NordVPN and testing on No-VPN yields up to 8% higher accuracy than competing models. Under cross-domain evaluation, baselines such as RBRN and MetaMRE fluctuate across datasets, while GETAmaintains stable accuracy, demonstrating its ability to learn domain-invariant representations and its effectiveness for real-world deployments with limited labeled data.

RQ2: Impact of N-way K-shot Configurations

We assess GETA’s robustness to task complexity by varying the number of classes (\(N\)) and labeled samples per class (\(K\)). This analysis examines how performance scales from simple binary to multi-class scenarios, reflecting realistic ETA deployments that must handle diverse traffic types. Experimental Setup: We construct meta-training and evaluation tasks with varying \(N\) and \(K\) under strict cross-dataset conditions to test generalization. Specifically, training and testing datasets are disjoint: NordVPN \(\rightarrow\) No-VPN (application), UNSW-IoT \(\rightarrow\) Aalto-IoT (device), and ToN-IoT \(\rightarrow\) CIC-IDS2017 (attack). This setup ensures evaluation on unseen domains that are representative of real-world conditions.

3.5pt

Results: As shown in Figure 5, GETAconsistently achieves the highest accuracy across all N-way, K-shot settings. While baseline methods degrade sharply as the number of classes increases, GETAdegrades gracefully, with only a 12% drop from 2-way 5-shot to 10-way 5-shot. Notably, it outperforms RBRN by up to 35% in the 10-way 10-shot setting.

Extended evaluations (Table 3) up to 100-way classification confirm stable performance, with minimal accuracy loss even in 50- and 100-way tasks, demonstrating scalability. Across IoT and attack detection tasks, GETAremains the top-performing option in most configurations, with only minor degradation in selected high-complexity settings. Overall, these results show that GETAoffers strong cross-dataset generalization, stable performance, and practical scalability for real-world ETA.

3pt

RQ3: Effectiveness of GETAin VPN Traffic Header-based models struggle in VPN environments where tunneling encapsulates original packet headers  [7]. To evaluate robustness, we compare GETAwith three metadata-based baselines (MetaRocket, MetaMRE, RBRN) and one header-dependent model (UMVD).

Experimental Setup: We use five datasets [7] that contain identical applications under both VPN and non-VPN conditions. We adopt a 2-way 5-shot setting with cross-validation training on four VPN datasets and testing on the remaining one, rotating across all combinations.

Results: As shown in Figure 6, UMVD performs poorly under VPNs due to header obfuscation, while metadata-based methods remain stable. GETAachieves the highest accuracy across all VPN settings, outperforming MetaMRE and RBRN by up to 5%, demonstrating strong robustness when header information is unavailable.

RQ4: Contribution of GETA’s Components and Hyperparameters We analyze the impact of two core components: the prototype enhancement (embedding enhancer and self-attention) and the class-specific head, alongside the effect of MAML through ablation studies. We also assess GETA’s sensitivity to two key hyperparameters: the \(\lambda\) weighting value and the input packet sequence length.

Experimental Setup:

We remove each component in turn and evaluate on few‑shot tasks meta‑trained on NordVPN and tested on No‑VPN. All variants share the same Transformer encoder for fair comparison. For hyperparameter analysis, we vary \(\lambda\) from 0.0 to 1.0 and test packet sequence lengths ranging from 5 to 1,000.

Results: Table 4 demonstrates that removing prototype enhancement causes the largest performance drop ( 7%), confirming its importance in refining support embeddings. Excluding the class-specific head reduces accuracy by  5%, further validating both modules as important to GETA’s few-shot capability.

Table 5 indicates that \(\lambda = 0.5\) provides the best balance for the dual-pathway loss. As shown in Fig. 7, performance is also highly sensitive to packet sequence length: accuracy is low for sequences of 100 packets or fewer, rises sharply at 200 packets, and peaks at 512 packets, which provides sufficient temporal context without adding excessive network noise.

8pt

5 Conclusion↩︎

This work presented GETA, a meta-learning-based framework for ETA that integrates a state-of-the-art time-series model with enhanced embedding techniques incorporating packet timing, packet size, and direction. GETA consistently outperformed state-of-the-art traffic metadata-based techniques, particularly in challenging scenarios such as VPN-encrypted environments. It further demonstrated strong adaptability in few-shot conditions, achieving high accuracy with only a few traffic flows per class, an important capability for scenarios where labeled data is scarce. By relying solely on traffic metadata, GETA effectively generalizes across various network conditions, as validated experimentally, positioning it as a promising solution for scalable cross-domain ETA.

6 Discussion↩︎

Key Findings: GETAdemonstrates robust performance across diverse encrypted traffic classification tasks, outperforming metadata-based baselines (MetaMRE, RBRN) and header-dependent methods (UMVD). Its incorporation of inter-arrival time alongside packet size and direction enriches temporal context, enabling superior generalization compared to methods that omit timing information.

Robustness to Network Variability: Metadata features such as packet size, timing, and direction can be distorted by MTU changes, congestion, retransmissions, or protocol behavior (see Figure 8). Despite this, GETAremains robust by modeling aggregate flow behavior rather than brittle packet-level bytes. This makes it resilient to encryption and network noise, maintaining visibility under adverse conditions

Scalability and Efficiency:

As demonstrated in RQ2, GETAexhibits controlled performance degradation as task complexity increases, unlike baselines that collapse sharply in high N-way settings. Resource consumption (Figure 9) remains manageable, with memory scaling from 165MB to 824MB and latency from 8.7ms to 14.2ms across increasing task complexity.

6.1 Limitations↩︎

While our proposed method demonstrates robust adaptability and high classification accuracy across diverse encrypted network conditions, it fundamentally relies on a few-shot learning paradigm. Specifically, the model requires a small, labeled support set for each novel traffic class to successfully fine-tune its decision boundaries. In highly dynamic real-world environments where emerging applications, novel IoT devices, or zero-day threats appear with absolutely no prior labeled samples, this dependency becomes a bottleneck. The current architecture cannot autonomously classify completely unseen traffic classes without this minimal baseline of prior knowledge.

6.2 Future Work↩︎

To address the data-scarcity bottleneck, future research should explore Zero-Shot Learning (ZSL) to identify entirely unseen applications. However, transitioning to ZSL in encrypted environments is exceptionally challenging. Applying representation learning directly to raw bytes causes models to exploit spurious dataset shortcuts rather than learning true protocol semantics, leading to catastrophic generalization failures [13]. Furthermore, while utilizing protocol-agnostic metadata such as our multivariate time-series features avoids these raw-byte shortcuts, it remains unclear how metadata alone can effectively translate to generalized zero-shot classification. A fundamental semantic gap exists because the feature space of encrypted traffic is notoriously high-dimensional and noisy, making it difficult to optimize a well-structured zero-shot embedding space without strong prior knowledge. Therefore, future ZSL implementations must investigate how to mathematically fuse robust metadata representations with external semantic knowledge (e.g., textual application descriptions or relational graphs) to accurately bridge this inferential gap.

References↩︎