Encrypted traffic classification stops retraining per task: ProtoSPM freezes one encoder across three label spaces
Synopsis
Encrypted traffic classification has required retraining the whole encoder whenever application or website labels change, and fine-tuned scores mix in downstream supervised learning. ProtoSPM arranges each bidirectional flow as a matrix of 51 protocol fields and pretrains by masked reconstruction on unlabeled backbone traffic, then freezes the encoder and trains only per-task heads. On ISCX-VPN-app, TLS-120 and CipherSpectrum, the complete 12.03M-parameter model reaches macro-averaged F1 of 61.29%, 67.98% and 71.28%, 2.13 to 26.65 points above a same-input, near-parameter-matched plain field Transformer.
Interpretation
One set of pretrained encoder weights no longer updates per task; separate classification heads let it serve application identification and website identification label spaces. Prior methods commonly pretrain on unlabeled traffic and then fine-tune the entire model with labeled data, so the encoder is rewritten by task labels and the reusability of the pretrained representation is hard to isolate. With the encoder frozen on ISCX-VPN-app, TLS-120 and CipherSpectrum, macro-averaged F1 is 61.29±1.54%, 67.98±1.23% and 71.28±1.20%, with the same encoder weights shared across all three datasets.
The encoder represents each bidirectional flow as a protocol-field matrix, with fields grouped by protocol origin and function into Other, IP, TCP, UDP and TLS handshake, and temporal convolution filters shared within each group. Type-aware embeddings route values by domain: binary fields and low-cardinality codes use lookup tables, time differences and payload lengths take log(1+x) before a linear projection, and remaining scalars are standardized then projected. Pretraining uses MAWI backbone traffic collected on January 1, 2025, yielding about 3.57 million TCP/UDP flows after parsing and aggregation, with the first 10 packets and 51 fields forming each input matrix.
Hierarchical field attention first attends within each protocol group, mean-pools the within-group outputs into five group summaries for across-group attention, and broadcasts the across-group context back to fields in each group. Flat attention over 51 fields needs 2601 field scores per time step, while the hierarchical structure totals 766 within-group and across-group scores. Each of the four encoder layers carries zero-initialized field-relation biases, 766 bias parameters per layer and 3064 across four layers, learned through pretraining gradients.
Perspective
The demonstrated scope is closed-set application and website identification: the same MAWI-pretrained encoder keeps its weights frozen on ISCX-VPN-app, TLS-120 and CipherSpectrum while only attention pooling and an MLP classification head are trained. Inputs are fixed at the first 10 packets and 51 fields of each bidirectional flow, using only plaintext protocol headers, packet-level behavioral measurements and parseable TLS handshake metadata, with no decryption keys or decrypted application payloads.
The fixed-width input matrix uses the same original-domain zero for short-flow padding, inapplicable fields and parsing failures, while valid fields can also equal zero. Random/operational fields behave differently across datasets: zeroing them lowers ISCX-VPN-app macro-averaged F1 by 2.08 points but raises TLS-120 by 0.98 points. Evaluation covers only closed-set identification, and behavior under temporal change, collection-environment shifts and unknown classes is not characterized, nor is the stability of the shared encoder across multiple pretraining initializations.