Few-Shot Encrypted Traffic Classification via Contrastive Meta-Learning (www.mdpi.com)

Researchers introduced CL-MetaFlow, a two-stage framework that tackles few-shot encrypted traffic classification by combining supervised contrastive representation learning with meta-learning adaptation. In stage one, a feature encoder is pre-trained with supervised contrastive loss on known traffic classes to produce a discriminative, metric-friendly embedding; in stage two that encoder initializes a Prototypical Network for rapid adaptation to novel classes from only a few labeled flows. The work also integrates a multi-view feature fusion pipeline (packet-size sequences, inter-arrival times, handshake metadata and flow statistics) tailored to encrypted traffic’s high-dimensional, noisy nature. This approach is significant because encrypted protocols (TLS 1.3, QUIC, DoH/DoT) have undermined payload inspection and created a steady stream of new, low-data classes (new apps, VPNs, covert C&C), where conventional pre-train/fine-tune or meta-learning-from-scratch struggle. On ISCX-VPN-2016 & ISCX-Tor-2017 benchmarks CL-MetaFlow achieved a five-way five-shot Macro F1 of 0.620, markedly beating ProtoNet-from-scratch (0.384), standard fine-tuning (0.160), SimCLR+ProtoNet (0.545) and a re-implemented T-Sanitation (0.591). Ablations show the domain-adapted contrastive prior is the key enabler, demonstrating that decoupling representation shaping and few-shot adaptation yields a practical, high-performance solution for real-world encrypted traffic analysis.