Few shot learning approaches for classifying rare mobile-app encrypted traffic samples

Deep Learning (DL) is effective for classifying encrypted network traffic. However, it requires large amounts of labeled data to feed typical data-hungry training processes. Unfortunately, collecting and labeling rich network-traffic datasets is a complex and costly procedure not always affordable in practice, possibly hindering DL solutions. Few Shot Learning (FSL) aims at tackling this shortcoming, providing means to leverage non-few knowledge to support classification tasks related to traffic with few labeled data available. Although FSL has been largely investigated in other domains (e.g., computer vision), it has been only preliminarily adopted for the classification of encrypted traffic. In this work, we provide a first attempt in adopting FSL for classifying mobile-app encrypted traffic. Specifically, we consider the two most popular FSL paradigms: meta learning (learn to learn) and transfer learning (knowledge transfer from related tasks). We consider a number of variants for each (namely MatchingNet, ProtoNet, RelationNet, MetaOptNet, fo-MAML, ANIL, Fine-Tuning, and Freezing) and provide an empirical assessment of these approaches when adopted for mobile-app traffic classification considering the Mirage-2019 dataset as a test bench. Results show that FSL in mobile-app traffic classification is feasible, reaching satisfactory results (up to 80% F1-score), but leaving room for improvement.