Southwest Petroleum University

Encrypted traffic classification has required retraining the whole encoder whenever application or website labels change, and fine-tuned scores mix in downstream supervised learning. ProtoSPM arranges each bidirectional flow as a matrix of 51 protocol fields and pretrains by masked reconstruction on unlabeled backbone traffic, then freezes the encoder and trains only per-task heads. On ISCX-VPN-app, TLS-120 and CipherSpectrum, the complete 12.03M-parameter model reaches macro-averaged F1 of 61.29%, 67.98% and 71.28%, 2.13 to 26.65 points above a same-input, near-parameter-matched plain field Transformer.

Encrypted traffic classification has required retraining the whole encoder whenever application or website labels change, and fine-tuned scores mix in downstream supervised learning. ProtoSPM arranges each bidirectional flow as a matrix of 51 protocol fields and pretrains by masked reconstruction on unlabeled backbone traffic, then freezes the encoder and trains only per-task heads. On ISCX-VPN-app, TLS-120 and CipherSpectrum, the complete 12.03M-parameter model reaches macro-averaged F1 of 61.29%, 67.98% and 71.28%, 2.13 to 26.65 points above a same-input, near-parameter-matched plain field Transformer.