Meta mimetic: few-shot classification of mobile-app encrypted traffic via multimodal meta-learning

Despite its proven effectiveness in classifying encrypted network traffic, deep learning requires large amounts of labeled data to feed typical data-hungry training processes. Few-shot learning provides means to overcome these limitations, supporting classification tasks related to traffic with few labeled data available. Its extensive investigation in other domains notwithstanding (e.g., computer vision), it has been only preliminarily adopted for classifying encrypted traffic.In this work, we design and evaluate Meta Mimetic a novel multimodal few-shot learning solution for classifying mobile-app encrypted traffic. The proposal is based on the meta-learning paradigm and introduces enhancements via the adoption of a multimodal feature extractor trained via a novel ad-hoc meta-learning procedure. Since Meta Mimetic is orthogonal to the specific few-shot learning approach, in our experimentation, we adapt it to a number of different meta-learning approaches (namely MatchingNet, ProtoNet, RelationNet, MetaOptNet, foMAML, and ANIL). We provide an empirical assessment of these approaches, considering the Mirage-2019 dataset as a test bench. Results show that Meta Mimetic represents the best trade-off in terms of performance and complexity in mobile-app traffic classification (up to 91% F1-score) when compared to state-of-the-art solutions. The in-depth analysis of the performance of its components allows us to shed light on the multimodal internal mechanisms and further improve classification performance. Finally, we demonstrate the robustness of our proposal (only ≈ 2% F1-score drop) against the next variations introduced by the TLS 1.3 encryption that may impair the information exploitable by payload-based traffic classifiers.