GETA: Generalized Encrypted Traffic Analysis

Source: arXiv:2605.31277 · Published 2026-05-29 · By Ransika Gunasekara, Rahat Masood, Salil Kanhere

TL;DR

This paper addresses the rising challenge that encryption poses for traditional traffic analysis methods which rely on inspecting packet payloads or headers. It introduces GETA, a protocol-agnostic encrypted traffic analysis framework that models network flows as multivariate time series using only metadata features such as packet size, direction, and inter-arrival times—completely avoiding packet payloads and header semantics. GETA leverages meta-learning combined with embedding refinement and self-attention mechanisms to enable few-shot adaptation to new, unseen domains with minimal labeled data. This methodology is evaluated extensively across nine diverse public datasets spanning application identification (including VPN traffic), IoT device fingerprinting, and attack detection. Compared to four state-of-the-art few-shot baselines, GETA consistently shows superior accuracy and robust generalization across intra-domain variations, cross-domain transfers, and challenging VPN tunneling scenarios. The paper demonstrates scalability to high-N, K-shot settings and analyzes internal components through ablation studies.

Key findings

• GETA achieves up to 8% higher accuracy than baselines like RBRN and MetaMRE in intra-domain generalization (e.g., NordVPN to No-VPN application ID).
• In cross-domain transfer (e.g., training on IoT device ID and testing on app or attack classification), GETA maintains stable accuracy while baselines fluctuate substantially.
• GETA degrades gracefully under increasing class counts from 2-way 5-shot to 10-way 5-shot, with only a 12% drop, whereas baselines suffer sharper accuracy losses.
• In 10-way 10-shot tasks, GETA outperforms RBRN by up to 35% macro F1 score.
• GETA sustains stable performance in up to 100-way 5-shot classification with minimal accuracy loss, demonstrating scalability.
• In VPN traffic classification where headers are obfuscated, GETA surpasses both metadata-based and header-dependent baselines, achieving the highest accuracy across all VPN test splits.
• Ablation shows removing the embedding enhancer, classification head, or meta-learning significantly drops accuracy (~5-7%), validating the necessity of each component.
• GETA uses only four metadata features (packet size, incoming and outgoing direction as separate binaries, inter-arrival time) and benefits from modeling them jointly as multivariate sequences.

Threat model

The adversary is an external observer attempting to classify encrypted network traffic without access to packet payloads or plaintext headers, e.g., behind VPN tunnels or encrypted DPI bypass. The adversary has access only to traffic metadata observable at flow-level granularity (packet sizes, directions, timings). The system aims to defeat or leverage this metadata for classification despite encryption and obfuscation. GETA does not assume compromised endpoints or payload decryption and does not consider attackers able to manipulate traffic features adversarially.

Methodology — deep read

The paper proposes GETA, a protocol-agnostic framework for encrypted traffic analysis based solely on network flow metadata (packet size, inter-arrival time, incoming and outgoing direction represented as two separate binary variables), representing flows as multivariate time series sequences of fixed length (s=512 time steps). The core base model is a modified UniTS transformer adapted for network traffic, using variable-wise multi-head self-attention across features (size, timing, direction) to capture cross-variable dependencies with efficient attention computed by averaging over the time dimension. A dynamic feed-forward network with temporal convolutions extracts local sequential patterns, followed by a learned task token performing cross-attention over feature tokens to produce a fixed-size embedding of dimension dE=256.

An embedding enhancer module refines the base embedding through layer normalization, a linear projection with ReLU activation, and final normalization. This reduces noise and stabilizes gradients, aiding few-shot adaptation. For classification, a prototype network approach is used: support embeddings per class are refined by multi-head self-attention to improve class prototype quality; these prototypes are further adapted by a two-layer MLP before being compared to query embeddings using temperature-scaled Euclidean distances to obtain classification probabilities via softmax.

A combined loss function is employed during meta-training: a weighted sum of prototype loss (cross-entropy on distances) and classification loss on both support and query sets to encourage linearly separable embeddings and robust few-shot generalization. The model parameters are optimized by Model-Agnostic Meta-Learning (MAML) to enable rapid adaptation to new tasks with few gradient steps on small support sets. The meta-training uses Nadapt=3 inner adaptation steps with learning rates α=0.001 (inner) and β=0.0001 (meta).

After meta-training, progressive fine-tuning is applied on downstream tasks: first optimizing the combined loss, then focusing on prototype loss alone, before final evaluation. This improves stability and reduces overfitting given limited data. All meta-learning episodes follow a strict N-way K-shot construction with disjoint support and query sets.

During evaluation, nine public datasets are used, spanning three task domains: application identification (five Appsniffer variants under different VPN and non-VPN conditions), IoT device identification (UNSW-IoT and Aalto-IoT), and attack detection (CIC-IDS 2017 and TON-IoT). Traffic is transformed into the consistent multivariate time-series format. Meta-training/testing datasets are strictly separated to measure cross-domain generalization. Macro-F1 is reported across 128 meta-test episodes, with results averaged over 5 random seeds and 95% confidence intervals computed. Comparison baselines are few-shot ETA methods: MetaMRE, MetaRocket, UMVD, and RBRN.

Ablation studies disable key components to assess their impact. Results show GETA strongly outperforms all baselines across intra- and cross-domain transfer, N-way K-shot varying complexity, and VPN tunneling datasets. The methodology leverages the strengths of metadata-driven representations and modern self-attention-based time series modeling with meta-learning to achieve robust, generalizable encrypted traffic classification with minimal labeled data. Source code and evaluation bundles are publicly released to support reproducibility.

Technical innovations

• A protocol-agnostic encrypted traffic representation modeling packet size, incoming direction, outgoing direction, and inter-arrival time jointly as a multivariate time series rather than relying on header or payload features.
• Modification and tailoring of UniTS transformer for traffic metadata, including variable-wise multi-head self-attention averaged over time dimension and dynamic feed-forward networks with temporal convolution to capture cross-variable and local temporal patterns.
• Embedding enhancement module that refines base embeddings via layer normalization, a linear projection with ReLU, and normalization to stabilize few-shot learning gradients and improve discriminability.
• Integration of meta-learning (MAML) with a combined dual-pathway loss comprising prototype loss and classification loss applied on both support and query sets to promote robust, generalizable few-shot embeddings.
• Self-attention mechanism applied on support embeddings to produce refined class prototypes, improving prototype quality for noisy, low-data support sets.

Datasets

• Appsniffer (No-VPN) — 7,500 samples (150 classes, 50 per class) — public from Appsniffer suite
• Appsniffer (SuperVPN) — 7,500 samples — public
• Appsniffer (NordVPN) — 7,500 samples — public
• Appsniffer (TurboVPN) — 7,500 samples — public
• Appsniffer (Surfshark) — 7,500 samples — public
• UNSW-IoT — 27 device classes, variable samples (1–20) — public
• Aalto-IoT — 28 device classes, ~20 samples per device — public
• CIC-IDS 2017 — 8 classes with 192–138,957 samples per class — public
• TON-IoT — 9 attack classes, 12 samples each — public

Baselines vs proposed

• MetaMRE: macro-F1 ≈ 0.83 vs GETA: 0.92 (2-way 5-shot intra-domain)
• RBRN: up to 35% lower macro-F1 than GETA in 10-way 10-shot tasks
• UMVD-FSL: poor performance on VPN datasets, macro-F1 significantly under GETA
• MetaRocket: consistently lower accuracy than GETA across all domains and transfer scenarios

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2605.31277.

Fig 1: Overall Methodology of GETA. (i) shows the traffic representation as a multivariate time series and embedding generation

Fig 2 (page 3).

Fig 2: Results for intra-domain tasks.

Fig 3: Results for cross-domain transfer tasks.

Fig 4: Few-shot accuracy across N-way settings, with standard deviations. Solid and dashed lines denote lower and higher K-shot

Fig 5: Comparison of classification accuracy across VPN dataset combinations.

Fig 6: Performance shift across different packet sequence

Fig 7: Four of the five datasets contain congestion and re-

Limitations

• Evaluation primarily on public datasets; real-world network environments may present additional variance and adversarial behaviors not modeled here.
• The model uses fixed-length sequences of 512 packets; very long or very short flows may require adaptation.
• No reported results on fully zero-shot transfer without labeled support data.
• Adversarial robustness, such as evasion by an informed attacker manipulating timing/size, is not evaluated.
• The meta-learning approach requires careful tuning of hyperparameters and multi-stage fine-tuning.
• Some IoT device classes had very limited samples and were excluded from evaluation, potentially biasing performance estimates.

Open questions / follow-ons

• How effective is GETA under active adversarial evasion attacks that manipulate metadata to confuse classifiers?
• Can zero-shot transfer be achieved by further generalizing the meta-learning framework or by exploiting self-supervised pretraining on unlabeled traffic?
• How would GETA perform on very long network flows or continuous streams where flow segmentation is non-trivial?
• What are the computational costs and scalability of GETA in high-throughput production network monitoring scenarios?

Why it matters for bot defense

GETA’s protocol-agnostic, metadata-driven approach to encrypted traffic classification can inform bot-defense and CAPTCHA systems aiming to distinguish legitimate from malicious traffic in environments where payload inspection is impossible or impractical. By modeling flows as multivariate time series of size, timing, and direction metadata and integrating meta-learning for few-shot adaptation, GETA provides a viable framework for detecting new botnet behaviors, VPN-based circumvention, or attack patterns with minimal labeled data. Its demonstrated robustness to domain shifts and encrypted tunnels suggests it can help CAPTCHA systems better assess device or application traffic identity under increasingly privacy-preserving contexts. However, practitioners should consider latency and computational cost trade-offs of transformer-based models and evaluate resilience against adversarial feature manipulation common in bot traffic.

Cite

@article{arxiv2605_31277,
  title={ GETA: Generalized Encrypted Traffic Analysis },
  author={ Ransika Gunasekara and Rahat Masood and Salil Kanhere },
  journal={arXiv preprint arXiv:2605.31277},
  year={ 2026 },
  url={https://arxiv.org/abs/2605.31277}
}

Read the full paper

• arXiv:2605.31277 (abstract)
• arXiv:2605.31277 (PDF)