GETA: Generalized Encrypted Traffic Analysis

• URL: http://arxiv.org/abs/2605.31277v1
• Date: Fri, 29 May 2026 13:09:35 GMT
• Title: GETA: Generalized Encrypted Traffic Analysis
• Abstract summary: GETA is a protocol-agnostic framework for encrypted traffic analysis.<n>It avoids reliance on packet payloads or header semantics.<n> GETA consistently outperforms state-of-the-art baselines.
• Score: 0.10923877073891443
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Traditional traffic analysis is being fundamentally challenged by the rapid adoption of encryption, tunnelling, and privacy-preserving protocols, which increasingly obscure packet payloads and limit the usefulness of Deep Packet Inspection (DPI). Although machine learning has advanced encrypted traffic analysis, existing approaches often remain tied to protocol-specific header features, depend on large labelled datasets, and degrade when deployed across heterogeneous network environments. We present GETA, a protocol-agnostic framework for encrypted traffic analysis that models network flows as multivariate time series using only traffic metadata, thereby avoiding reliance on packet payloads or header semantics. GETA combines meta-learning, embedding refinement, and self-attention to support few-shot adaptation to previously unseen domains with minimal labelled data. Across nine public datasets spanning application identification, VPN traffic classification, IoT device fingerprinting, and attack detection, GETA consistently outperforms state-of-the-art baselines. These results show that GETA offers a practical and generalisable foundation for robust traffic analysis in modern encrypted networks.

Related papers

• PrismWF: A Multi-Granularity Patch-Based Transformer for Robust Website Fingerprinting Attack [45.608550871415]
  Tor is a low-latency anonymous communication network that protects user privacy by encrypting website traffic.<n>Recent website fingerprinting (WF) attacks have shown that encrypted traffic can still leak users' visited websites by exploiting statistical features such as packet size, direction, and inter-arrival time.<n>We propose PrismWF, a multi-granularity patch-based Transformer for multi-tab WF attack.
  arXiv  Detail & Related papers  (2026-03-22T08:17:03Z)
• Things that Matter -- Identifying Interactions and IoT Device Types in Encrypted Matter Traffic [0.9176056742068813]
  We analyze the robustness of the Matter IoT standard to encrypted traffic analysis performed by a passive eavesdropper.<n>We identify patterns in metadata of the encrypted Matter traffic that allow inferring the specific interactions occurring between end devices and controllers.<n>These patterns can be used to create fingerprints that allow a passive attacker to infer the type of devices used in the network.
  arXiv  Detail & Related papers  (2026-02-02T10:34:06Z)
• Wireless Traffic Prediction with Large Language Model [54.07581399989292]
  TIDES is a novel framework that captures spatial-temporal correlations for wireless traffic prediction.<n> TIDES achieves efficient adaptation to domain-specific patterns without incurring excessive training overhead.<n>Our results indicate that integrating spatial awareness into LLM-based predictors is the key to unlocking scalable and intelligent network management in future 6G systems.
  arXiv  Detail & Related papers  (2025-12-19T04:47:40Z)
• Intelligent Detection of Non-Essential IoT Traffic on the Home Gateway [45.70482328441101]
  This work presents ML-IoTrim, a system for detecting and mitigating non-essential IoT traffic by analyzing network behavior at the edge.<n>We test our framework in a consumer smart home setup with IoT devices from five categories, demonstrating that the model can accurately identify and block non-essential traffic.<n>This research advances privacy-aware traffic control in smart homes, paving the way for future developments in IoT device privacy.
  arXiv  Detail & Related papers  (2025-04-22T09:40:05Z)
• MIETT: Multi-Instance Encrypted Traffic Transformer for Encrypted Traffic Classification [59.96233305733875]
  Classifying traffic is essential for detecting security threats and optimizing network management.<n>We propose a Multi-Instance Encrypted Traffic Transformer (MIETT) to capture both token-level and packet-level relationships.<n>MIETT achieves results across five datasets, demonstrating its effectiveness in classifying encrypted traffic and understanding complex network behaviors.
  arXiv  Detail & Related papers  (2024-12-19T12:52:53Z)
• Exploring QUIC Dynamics: A Large-Scale Dataset for Encrypted Traffic Analysis [7.795761092358769]
  We introduce VisQUIC, a large-scale dataset of 100,000 labeled QUIC traces from over 44,000 websites.<n>Unlike prior datasets, VisQUIC provides SSL keys for controlled decryption, supports multiple QUIC implementations, and introduces a novel image-based representation.<n>We present a benchmarking task for estimating HTTP/3 responses in encrypted QUIC traffic, achieving 97% accuracy using only observable packet features.
  arXiv  Detail & Related papers  (2024-09-30T10:50:12Z)
• Packet Inspection Transformer: A Self-Supervised Journey to Unseen Malware Detection with Few Samples [0.0]
  Traditional security measures are inadequate against the sophistication of modern cyber attacks.<n>Deep Packet Inspection (DPI) has been pivotal in enhancing network security.
  arXiv  Detail & Related papers  (2024-09-26T18:55:52Z)
• Application-layer Characterization and Traffic Analysis for Encrypted QUIC Transport Protocol [14.40132345175898]
  We propose a novel rule-based approach to estimate the application-level traffic attributes without decrypting QUIC packets. Based on the size, timing, and direction information, our proposed algorithm analyzes the associated network traffic. The inferred HTTP attributes can be used to evaluate the QoE of application-layer services and identify the service categories for traffic classification in the encrypted QUIC connections.
  arXiv  Detail & Related papers  (2023-10-10T20:09:46Z)
• Machine Learning for Encrypted Malicious Traffic Detection: Approaches, Datasets and Comparative Study [6.267890584151111]
  In post-COVID-19 environment, malicious traffic encryption is growing rapidly. We formulate a universal framework of machine learning based encrypted malicious traffic detection techniques. We implement and compare 10 encrypted malicious traffic detection algorithms.
  arXiv  Detail & Related papers  (2022-03-17T14:00:55Z)
• MD-CSDNetwork: Multi-Domain Cross Stitched Network for Deepfake Detection [80.83725644958633]
  Current deepfake generation methods leave discriminative artifacts in the frequency spectrum of fake images and videos. We present a novel approach, termed as MD-CSDNetwork, for combining the features in the spatial and frequency domains to mine a shared discriminative representation.
  arXiv  Detail & Related papers  (2021-09-15T14:11:53Z)
• Decoder Fusion RNN: Context and Interaction Aware Decoders for Trajectory Prediction [53.473846742702854]
  We propose a recurrent, attention-based approach for motion forecasting. Decoder Fusion RNN (DF-RNN) is composed of a recurrent behavior encoder, an inter-agent multi-headed attention module, and a context-aware decoder. We demonstrate the efficacy of our method by testing it on the Argoverse motion forecasting dataset and show its state-of-the-art performance on the public benchmark.
  arXiv  Detail & Related papers  (2021-08-12T15:53:37Z)
• Privacy-preserving Traffic Flow Prediction: A Federated Learning Approach [61.64006416975458]
  We propose a privacy-preserving machine learning technique named Federated Learning-based Gated Recurrent Unit neural network algorithm (FedGRU) for traffic flow prediction. FedGRU differs from current centralized learning methods and updates universal learning models through a secure parameter aggregation mechanism. It is shown that FedGRU's prediction accuracy is 90.96% higher than the advanced deep learning models.
  arXiv  Detail & Related papers  (2020-03-19T13:07:49Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.