FlowSem-MAE: A Protocol-Native Tabular Pretraining Paradigm for Encrypted Traffic Classification

Researchers from arXiv have introduced FlowSem-MAE, a novel self-supervised learning framework designed to improve encrypted traffic classification. Existing methods that flatten network traffic into byte sequences often fail to reduce reliance on labeled data due to an inductive bias mismatch that destroys protocol-defined semantics. The authors identify three critical issues with current approaches: field unpredictability in random fields, embedding confusion among distinct semantic fields, and the loss of essential capture-time metadata. To address these challenges, the team proposes a protocol-native paradigm that treats traffic data as having an intrinsic tabular modality. FlowSem-MAE utilizes Flow Semantic Units (FSUs) with predictability-guided filtering, FSU-specific embeddings, and dual-axis attention mechanisms to preserve field boundaries and capture temporal patterns. Experimental results demonstrate that this model significantly outperforms state-of-the-art methods across various datasets. Notably, FlowSem-MAE achieves superior accuracy using only half the amount of labeled data required by existing methods trained on full datasets, marking a significant advancement in efficient network traffic analysis and cybersecurity.