Traditional traffic analysis is being fundamentally challenged by the rapid adoption of encryption, tunnelling, and privacy-preserving protocols, which increasingly obscure packet payloads and limit the usefulness of Deep Packet Inspection (DPI). Although machine learning has advanced encrypted traffic analysis, existing approaches often remain tied to protocol-specific header features, depend on large labelled datasets, and degrade when deployed across heterogeneous network environments. We present GETA, a protocol-agnostic framework for encrypted traffic analysis that models network flows as multivariate time series using only traffic metadata, thereby avoiding reliance on packet payloads or header semantics. GETA combines meta-learning, embedding refinement, and self-attention to support few-shot adaptation to previously unseen domains with minimal labelled data. Across nine public datasets spanning application identification, VPN traffic classification, IoT device fingerprinting, and attack detection, GETA consistently outperforms state-of-the-art baselines. These results show that GETA offers a practical and generalisable foundation for robust traffic analysis in modern encrypted networks.

翻译：传统流量分析正受到加密、隧道和隐私保护协议的快速普及带来的根本性挑战，这些协议日益隐藏数据包载荷，并限制了深度包检测（DPI）的有效性。尽管机器学习推动了加密流量分析的发展，但现有方法通常仍依赖于特定协议的头部特征、大量标注数据集，并在异构网络环境中部署时性能下降。我们提出了GETA，一种协议无关的加密流量分析框架，该框架仅利用流量元数据将网络流建模为多元时间序列，从而避免了对数据包载荷或头部语义的依赖。GETA结合了元学习、嵌入精炼和自注意力机制，支持对未见过的域进行少量样本自适应，仅需极少的标注数据。在跨应用识别、VPN流量分类、物联网设备指纹识别和攻击检测的九个公开数据集上，GETA始终优于现有最优基线方法。这些结果表明，GETA为现代加密网络中的鲁棒流量分析提供了实用且可泛化的基础。