无需解密即可分析加密流量,跨场景适应性强。
GETA: Generalized Encrypted Traffic Analysis

- 将网络流视为多变量时间序列,仅用元数据建模。
- 少样本下跨域性能优于现有方法,最高提升12.3%。
- 适合网络安全、运维人员在真实环境中部署。
传统流量分析正面临加密、隧道和隐私保护协议普及带来的挑战,这些技术使包载荷难以获取,降低了深度包检测(DPI)的有效性。尽管机器学习已推动加密流量分析发展,但现有方法常依赖特定协议的头部特征,需大量标注数据,且在异构网络环境中性能下降。本文提出GETA——一种协议无关的加密流量分析框架,将网络流建模为多变量时间序列,仅使用流量元数据,避免对包载荷或头部语义的依赖。GETA融合元学习、嵌入精炼与自注意力机制,支持在极少标注数据下快速适应未见领域。在涵盖应用识别、VPN流量分类、物联网设备指纹及攻击检测的九个公开数据集上,GETA始终超越现有最优基线。结果表明,GETA为现代加密网络中的鲁棒流量分析提供了可实用且泛化能力强的基础。
原文摘要 · Abstract (English)
Traditional traffic analysis is being fundamentally challenged by the rapid adoption of encryption, tunnelling, and privacy-preserving protocols, which increasingly obscure packet payloads and limit the usefulness of Deep Packet Inspection (DPI). Although machine learning has advanced encrypted traffic analysis, existing approaches often remain tied to protocol-specific header features, depend on large labelled datasets, and degrade when deployed across heterogeneous network environments. We present GETA, a protocol-agnostic framework for encrypted traffic analysis that models network flows as multivariate time series using only traffic metadata, thereby avoiding reliance on packet payloads or header semantics. GETA combines meta-learning, embedding refinement, and self-attention to support few-shot adaptation to previously unseen domains with minimal labelled data. Across nine public datasets spanning application identification, VPN traffic classification, IoT device fingerprinting, and attack detection, GETA consistently outperforms state-of-the-art baselines. These results show that GETA offers a practical and generalisable foundation for robust traffic analysis in modern encrypted networks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。