# GETA: Generalized Encrypted Traffic Analysis

arXiv: https://arxiv.org/abs/2605.31277 · HTML: https://mlsanity.com/paper/2605.31277/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 13 of its 43 references that are in the map.
- First posted on arXiv 29 May 2026.

## Builds on (most cited first, 13 of 13)

- [Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks](https://mlsanity.com/paper/1703.03400/) (2017)
- [Prototypical Networks for Few-shot Learning](https://mlsanity.com/paper/1703.05175/) (2017)
- [One Fits All:Power General Time Series Analysis by Pretrained LM](https://mlsanity.com/paper/2302.11939/) (2023)
- [Transformers in Time Series: A Survey](https://mlsanity.com/paper/2202.07125/) (2022)
- [UniTS: A Unified Multi-Task Time Series Model](https://mlsanity.com/paper/2403.00131/) (2024)
- [MultiRocket: Multiple pooling operators and transformations for fast and effective time series classification](https://mlsanity.com/paper/2102.00457/) (2021)
- [ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification](https://mlsanity.com/paper/2202.06335/) (2022)
- [NetMamba: Efficient Network Traffic Classification via Pre-training Unidirectional Mamba](https://mlsanity.com/paper/2405.11449/) (2024)
- [Var-CNN: A Data-Efficient Website Fingerprinting Attack Based on Deep Learning](https://mlsanity.com/paper/1802.10215/) (2018)
- [SoK: Decoding the Enigma of Encrypted Network Traffic Classifiers](https://mlsanity.com/paper/2503.20093/) (2025)
- [Network Traffic Classification based on Single Flow Time Series Analysis](https://mlsanity.com/paper/2307.13434/) (2023)
- [ZEST: Attention-based Zero-Shot Learning for Unseen IoT Device Classification](https://mlsanity.com/paper/2310.08036/) (2023)
- [Towards Robust Multi-tab Website Fingerprinting](https://mlsanity.com/paper/2501.12622/) (2025)

## Abstract (arXiv)

Traditional traffic analysis is being fundamentally challenged by the rapid adoption of encryption, tunnelling, and privacy-preserving protocols, which increasingly obscure packet payloads and limit the usefulness of Deep Packet Inspection (DPI). Although machine learning has advanced encrypted traffic analysis, existing approaches often remain tied to protocol-specific header features, depend on large labelled datasets, and degrade when deployed across heterogeneous network environments. We present GETA, a protocol-agnostic framework for encrypted traffic analysis that models network flows as multivariate time series using only traffic metadata, thereby avoiding reliance on packet payloads or header semantics. GETA combines meta-learning, embedding refinement, and self-attention to support few-shot adaptation to previously unseen domains with minimal labelled data. Across nine public datasets spanning application identification, VPN traffic classification, IoT device fingerprinting, and attack detection, GETA consistently outperforms state-of-the-art baselines. These results show that GETA offers a practical and generalisable foundation for robust traffic analysis in modern encrypted networks.