Encrypted Network Traffic Analysis

The field studies how to infer traffic classes, intrusions, website visits, and quality of experience from signals such as packet sizes, timing, flow metadata, and TLS records. Common approaches include sequence models and self-supervised pretraining, protocol-aware representations, graph or mixture-of-experts models, and few-shot adaptation; some systems also use federated learning or lightweight models for edge deployment. These methods are evaluated on tasks such as encrypted application classification, open-world website fingerprinting, and anomaly detection, including settings with temporal or geographic shifts. A central tension is that models must remain accurate and efficient as traffic changes or is manipulated, while avoiding reliance on shortcuts, evaluation leakage, and opaque predictions.