ProtoSPM: Protocol-Structured Pretraining for Encoder Reuse in Encrypted Traffic Classification
Year: 2026
Type: preprint
Abstract: Reusable traffic representations can reduce repeated encoder training as application and website labels change. Existing methods commonly pretrain on unlabeled traffic and fine-tune the entire model using labeled data. However, full-model fine-tuning updates the encoder using task-specific labels, making it difficult to isolate the reusability of pretrained representations. We investigate how unlabeled traffic can yield a shared encoder that balances representation quality and model size while supporting different classification tasks without backbone updates. We propose ProtoSPM, a parameter-efficient pretraining model guided by protocol structure. It represents bidirectional flows as protocol-field matrices and learns traffic context through masked reconstruction. Type-aware embeddings, protocol-group temporal convolution, hierarchical field attention, and field-relation biases incorporate value semantics, local packet dynamics, and protocol dependencies into a compact encoder. After pretraining on unlabeled backbone-network traffic, the same encoder remains fixed while separate task heads are trained. On ISCX-VPN-app, TLS-120, and CipherSpectrum, the 12.03M-parameter model achieves macro-averaged F1 (Macro-F1) scores of 61.29±1.54%, 67.98±1.23%, and 71.28±1.20%, respectively. These scores exceed a same-input, near-parameter-matched plain field Transformer by 2.13-26.65 percentage points. The results show that ProtoSPM learns useful shared representations from unlabeled traffic and supports adaptation to different classification label spaces without updating encoder weights.
Source: Research Square
Authors: Wenlei Dai, Qin Luo, Peng Wu
Institutions: Southwest Petroleum University, Sichuan Tourism University
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225582106