SEROA: Stable Encrypted-Traffic Representation and Online Adaptation for Service-Aware Networks

1

SEROA: Stable Encrypted-Traffic Representation and Online Adaptation for Service-Aware Networks Zongxi Liu, Shuai Mao, Jie Chuai, and Hongyang Du∗

arXiv:2611.07550v1 [cs.NI] 5 Nov 2026

✦

Abstract—Mobile networks are evolving toward service-aware operation to support heterogeneous applications with diverse quality-ofservice (QoS) and quality-of-experience (QoE) requirements. In practice, however, the widespread use of encryption makes service types difficult to observe directly, which limits the deployment of service-aware optimization in operational networks. Recent raw-byte representation learning methods have improved offline encrypted-traffic classification, but their robustness in realistic deployment remains limited due to temporal drift and the lack of explicit labels for online adaptation. This paper proposes Stable Encrypted-Traffic Representation and Online Adaptation (SEROA), a deployment-oriented framework for encryptedtraffic classification in service-aware mobile networks. In the offline stage, SEROA exploits protocol structure to learn temporally stable representations by applying masked modeling to stable fields, protocolaware transformations and contrastive learning to unstable fields, and time-adversarial learning to suppress time-specific cues. In the online stage, SEROA uses feedback records containing QoE measurements, wireless states, and allocation decisions to update the deployed classifier through contextual-bandit learning. Experiments show that SEROA consistently outperforms representative pretrained baselines under both random and time-based evaluation protocols, and remains effective under QoE-driven online adaptation. These results demonstrate the value of stable representation learning and online adaptation for practical service-aware mobile networks. Index Terms—Encrypted traffic classification, online learning, temporal drift, representation learning.

1

I NTRODUCTION

M

OBILE networks are evolving from the traditional best-effort service model toward a service-aware paradigm, driven by the rapid growth of latency-sensitive and experience-driven applications such as artificial intelligence (AI) agents, eXtended Reality (XR), cloud gaming, and live streaming [1]–[4]. To meet these heterogeneous requirements, 5G and the emerging 5G-Advanced/6G architectures introduce fine-grained quality-of-service (QoS) management mechanisms, including QoS Flows, the 5G QoS Identifier (5QI), and the QoS Flow Identifier (QFI) [5], [6]. The core network can configure QoS parameters according to the service type, and the radio access network (RAN) can

Zongxi Liu and Hongyang Du are with the Department of Electrical and Computer Engineering, The University of Hong Kong, Hong Kong SAR, China (e-mail: duhy@hku.hk). Shuai Mao and Jie Chuai are with Noah’s Ark Lab, Huawei Technologies Ltd., Hong Kong SAR, China.

in turn exploit this information for base station (BS) radio resource scheduling, thereby improving the user-perceived quality-of-experience (QoE) [7]–[10]. In practice, however, obtaining such service-type information has become increasingly difficult because most operational traffic is now encrypted. The widespread deployment of transport layer security (TLS) has made encrypted traffic increasingly ubiquitous in operational networks [11]. Encryption hides application-layer payloads and most protocol semantics, rendering traditional deep packet inspection (DPI) methods that rely on plaintext content largely ineffective [12]. As a result, the service-type information assumed by many service-aware optimization studies is not directly observable in encrypted mobile networks, which limits the practical deployability of service-aware resource management [10]. Consequently, accurately and robustly identifying the service type of each flow under encryption has become a central problem in service-aware mobile networking [10]. To infer service types from encrypted traffic, recent encrypted-traffic classification studies have shifted from manual inspection and hand-crafted features to representation learning from observable packet bytes. Representative methods such as ET-BERT [13], YaTC [14], and NetMamba [15] adapt masked modeling from natural language processing (NLP) and computer vision (CV) to encrypted traffic, and achieve strong performance on offline classification benchmarks. These results suggest that raw-byte traffic contains exploitable signals for service identification, while removing the dependence on hand-crafted features. Despite this progress, existing raw-byte-based pretraining approaches remain largely confined to idealized offline evaluation, and their robustness in real mobile-network deployment remains limited [16]–[18]. In deployment, a classifier is pretrained and fine-tuned on historical traffic, and then applied to future flows whose distribution shifts as applications and protocols evolve over time. This temporal drift can substantially degrade the accuracy of encryptedtraffic classifiers [16], [19], [20]. If the pretrained encoder encodes time-specific shortcuts, fine-tuning has limited ability to remove them, and temporal drift can induce larger performance degradation [17], [18]. We argue that this limitation mainly comes from two causes. The first is field-agnostic pretraining. Existing meth-

2

ods directly transplant NLP or CV objectives to encrypted traffic and treat all bytes as homogeneous tokens or patches [13], [14], [21], [22]. Encrypted traffic contains protocolstructural fields, environment-dependent statistical fields, and session-specific or cryptographically opaque fields, whose semantics and temporal stability differ substantially. In particular, IP, TCP, and TLS fields can have different stability properties. A uniform pretraining objective can spend capacity reconstructing random content or memorizing environment-specific patterns, yielding representations that generalize poorly across time. The second cause is insufficient support for online adaptation. When the deployment distribution drifts substantially, historical offline training alone cannot ensure accurate prediction for current traffic, and the classifier must adapt to the new distribution. Existing raw-byte pretraining studies largely stop at offline evaluation and do not specify how a deployed model should learn online in a mobile network. Such learning is difficult because ground-truth service labels are usually unavailable after deployment. The network can only log weak deployment signals, such as radio conditions, scheduling outcomes, and QoE measurements, which are noisy and indirectly related to class labels. Offline pretraining must therefore produce representations robust enough to support lightweight online updates under noisy weak feedback. Motivated by these observations, we propose Stable Encrypted-Traffic Representation and Online Adaptation (SEROA), a deployment-oriented framework for encryptedtraffic classification in service-aware mobile networks. SEROA first learns temporally stable traffic representations by exploiting protocol structure and reducing the influence of time-sensitive fields. It then supports lightweight online adaptation after deployment by using feedback records containing QoE, wireless-state, and allocation information. This design connects robust offline pretraining with online service-aware resource allocation under temporal drift. Our main contributions are summarized as follows. •

•

•

•

We conduct a deployment-aware empirical analysis of representative raw-byte pretrained classifiers, showing that their strong random-split performance does not directly transfer to time-based testing or frozen-encoder adaptation. This performance gap motivates stable representations and online adaptation for practical deployment. We propose a protocol-aware offline pretraining framework that combines stable-field masked modeling, protocol-aware transformations, contrastive learning, and time-adversarial learning to learn representations that remain robust across time and effective under lightweight adaptation. We design a joint online feedback framework between the core network and the RAN, which uses classification-assisted resource allocation and feedback records containing QoE, wireless-state, and allocation information to update the deployed classifier through online contextual-bandit learning. We conduct extensive offline and online experiments on public CSTNET datasets. The results show consistent gains over representative pretrained baselines in both offline evaluation settings and under QoE-

driven online adaptation. The remainder of this paper is organized as follows. Section 2 reviews related work. Section 3 formalizes the deployment pipeline and the service-aware allocation model. Section 4 presents the deployment gap analysis. Section 5 introduces the proposed pretraining method. Section 6 develops the online adaptation mechanism, and Section 7 reports the experimental results.

2

R ELATED W ORK

2.1

Encrypted Traffic Classification

Early network-traffic classifiers relied on port numbers and DPI, matching signatures against plaintext headers or payloads. The deployment of TLS-based encryption has reduced the visibility of application-layer content, and shifted traffic classification toward side-channel signals such as packet length, packet direction, timing, and early flow behavior [23]–[25]. Taylor et al. showed that encrypted mobile applications can be identified from statistical fingerprints extracted from traffic traces, as demonstrated by AppScanner and a later robustness-oriented follow-up study [19], [26]. Lotfollahi et al. and Rezaei et al. then introduced end-to-end deep models over raw packets or early-flow features, improving classification accuracy under encrypted payloads [27], [28]. Other studies map flows into intermediate representations, such as flowpic images, and exploit convolutional, few-shot, or contrastive learning architectures [29], [30]. However, the wide deployment of TLS and rapidly evolving application protocols has reduced the reliability of such manually designed features. As payload semantics are hidden and traffic patterns change across versions, devices, and deployment environments, classifiers based on fixed statistical descriptors become increasingly difficult to generalize. To reduce the dependence on hand-crafted features, recent work has further moved from supervised deep models to raw-byte self-supervised pretraining. Lin et al. proposed ET-BERT, which learns contextual datagram representations with masked language modeling [13]. Zhao et al. introduced YaTC, which adapts masked autoencoding to traffic bytes [14]. Wang et al. proposed NetMamba, which improves long-sequence traffic modeling with state-space architectures [15]. Chen et al. and Liu et al. developed MIETT and FlowletFormer to model packet-to-flow relations and protocol-aligned context for traffic representation learning [31], [32]. These methods demonstrate the value of raw-byte representations for encrypted-traffic classification. However, they treat packet bytes as homogeneous tokens and adopt pretraining objectives from NLP or computer vision. The heterogeneous stability properties of IP, TCP, and TLS fields are therefore not explicitly modeled in these pretraining objectives. 2.2

Drift Robustness

Temporal drift is an important challenge for encryptedtraffic classification. It can be induced by server-side deployment changes, device heterogeneity, and evolving user behavior. Earlier mobile-app fingerprinting studies reported accuracy variation across time, devices, and application

3

versions [19]. Recent evaluations further show that randomsplit benchmarks can substantially overestimate deployment performance when future traffic is chronologically separated from the training data [16], [17]. Malekghaini et al. studied classifier aging in mobile-network traffic and explored lightweight architectures for future data [20]. Shapira et al.’s FlowPic and related systematization-of-knowledge (SoK)-style studies also report performance degradation under distribution shift and emphasize the limitations of static legacy benchmarks [18], [29]. These studies establish the importance of time-based evaluation and drift-aware encrypted-traffic classification. However, most existing analyses and mitigation methods are still built on flow-level statistics, image-like flow descriptors, graph representations, architecture search, or postdeployment model updates. Cui et al. proposed FG-SAT, which selects stable attributes from flow-graph representations to reduce environmental sensitivity [33]. Chen et al. proposed drift-oriented self-evolving encrypted-traffic classification, which updates a deployed classifier with imperfect labels [34], while Lin et al. addressed non-independentand-identically-distributed (non-IID) traffic classification through self-supervised instruction tuning in ETooL [35]. Despite improving robustness to distribution shifts, these methods are not suitable for raw-byte pretraining. 2.3 Service-Aware Mobile Networking and Online Adaptation Service-aware mobile networking is supported by the 5G QoS architecture. The 3GPP TS 23.501 defines QoS Flows, 5QI, and QFI as standard mechanisms for mapping service requirements to forwarding and access-side treatment [5]. The next-generation RAN (NG-RAN) then binds QoS flows to radio resources according to the configured QoS profiles [6], [36]. In this context, encrypted-traffic classification supplies the service type required for QoS management and dynamic resource allocation. Fei et al. studied real-time encrypted-traffic classification in 5G non-standalone (NSA) networks as a support module for QoS control and mobilenetwork resource management [12], [37]. In parallel, QoE-oriented scheduling, application-aware resource allocation, and slice-aware RAN optimization have developed into active research directions. QoE-aware wireless scheduling studies optimize radio resources for user-perceived experience [38]. Reinforcement learning and contextual-bandit methods have also been used for RAN slicing, Open RAN (O-RAN) control, and cellular-network configuration [9], [39]. Bronzino et al. inferred streaming video quality from encrypted traffic, and Dimopoulos et al. measured video QoE from encrypted traffic [4], [40]. These works show that service identification, QoE estimation, and online wireless control are individually feasible. However, public studies rarely couple them into a closed loop in which the classifier supports RAN scheduling and RAN-side QoE feedback records are used to update the deployed classifier itself. Overall, prior work has advanced encrypted-traffic representation learning, drift-aware evaluation, and serviceaware mobile-network optimization along largely separate directions. Existing raw-byte pretraining methods mainly

target offline classification, drift-robust methods are not designed for raw-byte pretraining models, and service-aware networking studies usually treat traffic classifiers as fixed inputs to resource allocation. Therefore, the joint problem of temporally robust raw-byte representation learning, QoEdriven RAN scheduling, and label-free online classifier adaptation remains insufficiently studied. This paper addresses this gap by incorporating protocol-field stability into pretraining and updating a lightweight classifier head from RAN-side QoE feedback records after deployment.

3

S YSTEM M ODEL AND P ROBLEM F ORMULATION

3.1 Deployment Pipeline for Encrypted-Traffic Representation Deploying an encrypted-traffic classification model in a mobile network typically involves three stages: offline pretraining, downstream fine-tuning, and online inference at deployment time as shown in Fig. 1. 3.1.0.1 Pretraining: The network first collects a large dataset of encrypted traffic with M samples from historical operations

Dpre = {(xj , tj )}M j=1 ,

tj < T0 ,

(1)

where xj is an encrypted-traffic sample, tj is its capture time, and T0 is the time at which the model is trained and ready for deployment. Pretraining is carried out in a selfsupervised manner that does not rely on manual labels and learns representations from past traffic:

θ0 = arg min Lpre (Dpre ; θ) , θ

(2)

where fθ (·) denotes the encoder and Lpre can take the form of masked modeling or other self-supervised objectives [13]–[15]. 3.1.0.2 Fine-Tuning: After pretraining, the model is adapted to the downstream classification task using a set of labeled historical data with M ′ samples ′

Dft = {(xj , yj , tj )}M j=1 ,

tj < T0 ,

(3)

where yj ∈ C denotes the service class or application type of the flow and C is the set of admissible services or applications. Two typical fine-tuning strategies are considered. The first, unfrozen fine-tuning, jointly updates the pretrained encoder and the classification head: X (θ∗ , ϕ∗ ) = arg min ℓ(hϕ (fθ (xj )), yj ) , (4) θ,ϕ

(xj ,yj )∈Dft

where hϕ (·) is the classification head and ℓ(·) is the crossentropy loss. The second, frozen fine-tuning, keeps the encoder frozen and trains only the lightweight classification head: X ϕ∗ = arg min ℓ(hϕ (fθ0 (xj )), yj ) , θ = θ0 . (5) ϕ

(xj ,yj )∈Dft

Although unfrozen full-parameter fine-tuning typically attains stronger offline accuracy, it degrades model stability and generalization. Therefore, both strategies remain viable depending on the target objective and deployment scenario.

4

Offline Training

RAN

Core Network Arriving traffic 𝑡𝑗 > 𝑇0

Historical traffic

𝑁

~

𝒜cvx 𝐑 𝐠 = arg max

𝒟pre = { 𝑥𝑗 𝑡𝑗 }𝑀 𝑗=1 , 𝑡𝑗 ≤ 𝑇0 ,

𝐩

෍ log

1+

𝑊log 2 1 + 𝑔𝑖 𝑝𝑖 ~

𝑅𝑖

𝑖=1 𝑁

Self-supervised pretraining 𝜃0 = arg min ℒpre 𝒟pre 𝜃 ,

Inference

𝑠. 𝑡. ෍ 𝑝𝑖 ≤ 𝑃max , 𝑝𝑖 ≥ 0, ∀𝑖 ∈ 𝒩.

QFI

𝑖=1

𝑐Ƹ = arg max softmax ℎ𝜙 𝑓𝜃 𝑥 𝑐∈𝒞

𝜃

Deploy

Labeled historical data ′ 𝒟ft = { 𝑥𝑗 𝑦𝑗 𝑡𝑗 }𝑀 𝑗=1 , 𝑡𝑗 ≤ 𝑇0 , Unfrozen/Frozen Fine-tuning 𝜃 ∗ 𝜙 ∗ = arg min ෍ ℓ ℎ𝜙 𝑓𝜃 𝑥𝑗 𝜃,𝜙

𝑦𝑗

𝒟ft

ℎ1 5QI

QFI

𝑅0,𝑐

C1

3

1

50kb

C2

4

2

5Mb

C3

8

3

3Mb

𝑐Ƹ

…

ℎ0 ℎ3

ℎ2

𝑢0 𝑝0 𝑐0Ƹ

𝑢1 𝑝1 𝑐1Ƹ

…

𝑢2 𝑝2 𝑐2Ƹ

𝑢3 𝑝3 𝑐3Ƹ

Fig. 1. The pipeline of deploying an encrypted-traffic classification model in a mobile network.

3.1.0.3 Deployment Inference: 𝑐Ƹ =Once 𝐹𝜃,𝜙 𝑥trained, the model is shipped to inference modules co-located with the core network. For each newly arriving encrypted-traffic sample x ∼ Pt≥T0 (X), the classifier forms the class posterior ξ cls (x) = softmax(hϕ (fθ (x))) , (6) and emits the predicted service class ĉ = arg maxc∈C ξccls (x). x denotes an early-flow sample constructed from the initial packets of a newly arriving flow. The classifier is invoked once, and the resulting service prediction is retained throughout the flow lifetime for QoS mapping and scheduling. 3.2

Service-Aware Resource Allocation

Consider a single-cell downlink system in which the BS serves a set of active users N = {1, 2, . . . , N }. Each user i ∈ N is associated with one application flow whose true service class is ci ∈ C . The downlink transmission from the BS to user i is modeled as p √ zi = pi hi ai + ni , hi = βi h̃i (7) where zi is the received baseband signal at user i, pi is the transmit power allocated to user i, ai is the unit-power transmitted symbol, ni ∼ CN (0, σ 2 ) is additive white Gaussian noise, and CN denotes the circularly symmetric complex Gaussian distribution. The channel hi follows Rayleigh fading [41], h̃i ∼ CN (0, 1) is small-scale fading and βi is large-scale path loss. When the BS allocates transmit power pi to user i, the achievable downlink rate is

|hi |2 , ri = W log2 (1 + gi pi ). (8) σ2 where gi denotes the normalized channel gain, ri is the achievable downlink rate of user i, and W is the system bandwidth. The predicted service class ĉ is used by the core-network QoS control logic to select the treatment of the corresponding service data flow. Under policy control function (PCF) policy, the session management function (SMF) provides the QoS Flow context with the assigned gi =

QFI and 5QI to the RAN over N2, while the user plane function (UPF) marks N3 packets with the QFI, enabling the RAN to map the flow to radio resources according to the received QoS context [5], [6], [36]. We abstract the classdependent effect to a reference rate R0,c , defined as the baseline throughput required for a minimally acceptable experience of service class c. Motivated by the Weber– Fechner law [42], we adopt a logarithmic QoE model for each user i with service class ci :   ri ui (pi , ci ) = log 1 + R0,ci   (9) W log2 (1 + gi pi ) = log 1 + . R0,ci The inner ratio ri /R0,ci normalizes the radio-side rate by the service requirement, while the outer logarithm captures diminishing marginal returns. The RAN performs power allocation using the service information available on the QoS path. Let R̃ = [R̃1 , . . . , R̃N ] denote the reference rates used by the RAN for the active flows. For a fixed channel vector g = [g1 , . . . , gN ] and a fixed reference-rate vector R̃, define the convex allocation operator   N X W log2 (1 + gi pi ) Acvx (R̃, g) = arg max log 1 + p R̃i i=1

s.t.

N X

pi ≤ Pmax ,

pi ≥ 0, ∀i ∈ N .

i=1

(10) where Pmax is a total transmit-power budget. For fixed R̃, each term in the objective is concave in pi , and the feasible set is convex. Hence (10) can be solved directly by standard convex optimization methods. In current classification-assisted deployment, the corenetwork classifier emits the predicted classes ĉ = [ĉ1 , . . . , ĉN ]. The RAN then uses Predicted-Class allocation:

R̃ipred = R0,ĉi ,

ppred = Acvx (R̃pred , g).

(11)

The realized user experience is still governed by the true P pred service classes through i ui (pi , ci ). Therefore, classifi-

5

Service category

5QI

R0,c

C1 C2 C3 C4 C5

Interactive low-rate services Lightweight information-access services High-rate media and content services General data services Background support and distribution services

3 6 4 8 9

50 kbps 24 kbps 5 Mbps 3 Mbps 100 kbps

160 120 80

40

Dec

Jan 2021

Feb

Mar

Apr

May

Jun

flows per day

Class

Domain label

TABLE 1 Service profiles used to construct CSTNET-SERVICE and perform online evaluation.

cloudfront.net alicdn.com mozilla.org alipay.com ggpht.com gmail.com sohu.com yandex.ru 163.com wikipedia.org ieee.org taboola.com ctrip.com elsevier.com thepaper.cn python.org deepl.com jd.com Oct Nov 2020

Jul

Date (UTC)

(a) Per-label sample time distribution for the CSTNET

cation accuracy directly affects the mismatch between the allocation objective used by the RAN and the QoE perceived by users. When ĉi = ci for all active flows, the predictedclass allocation coincides with the Oracle allocation :

R̃iorc = R0,ci ,

porc = Acvx (R̃orc , g),

Random Split M1

M2

M3

M4

M5

M6

M7

M8

Time-based Split M9

M10 M11

M1

M2

M3

M4

M5

M6

M7

M8

M9 M10

M11

split point Train

Test

(b) Two evaluation protocols on CSTNET-SERVICE.

(12)

which serves as an ideal upper reference for classificationassisted allocation. Additionally, in some deployment and evaluation settings, the allocation module may not have access to reliable per-flow service-class information. For example, in LTE evolved packet core (EPC) deployments, the RAN-side scheduler may not receive an end-to-end QFI/5QI for each encrypted flow [5], [6], [36], [43]. In this low-information setting, all flows are assigned the same class-mix reference rate with a Class-Agnostic allocation: 1 X R̄0 = R0,c , pagn = Acvx (R̄0 1N , g), (13) |C| c∈C

Fig. 2. Temporal characteristics of the CSTNET dataset and the two evaluation protocols compared in this work.

where 1N denotes the N -dimensional all-one vector.

4.2

4

D EPLOYMENT G AP A NALYSIS

Building on the deployment setting defined in Section 3, this section examines whether existing pretrained encryptedtraffic models remain effective when applied to future traffic. We evaluate three representative methods, including ETBERT [13], YaTC [14], and NetMamba [15], on the public CSTNET dataset [13], where all three were originally reported to achieve Macro-F1 scores above 90%. 4.1

Dataset Construction and Evaluation Protocols

CSTNET is a public TLS 1.3 encrypted-traffic dataset whose flows are annotated with fine-grained application-type labels [13]. The collection window spans roughly eleven months, and the per-label arrival pattern is shown in Fig. 2a. To reduce confounding effects from limited support and uneven temporal coverage, we retain application types with sufficient samples and active days, adequate presence on both sides of the chronological boundary, and no excessive concentration on a single day. This procedure retains 89 of the original 120 application types and forms CSTNETAPP. We then aggregate the retained application types by service semantics into five categories C = {C1 , . . . , C5 } to form CSTNET-SERVICE. Table 1 summarizes their service profiles, standardized 5QI values, and reference rates R0,c used in the online evaluation [5], [44]–[46]. We evaluate CSTNET-SERVICE under two protocols. The first is the conventional random split, adopted by prior

work [13]–[15], shuffles all flows and partitions them into training and test sets with a 7:3 ratio. The other is the deployment-oriented time-based split uses the chronological threshold T0 = 2021-05-06. Samples collected before T0 form the training set, and those collected on or after T0 form the test set. Detailed cleaning criteria, the domainto-service mapping, and exact split indices are provided in the implementation. 1 The two protocols are illustrated in Fig. 2b. Existing Methods Degrade under Time-Based Split

Fig. 3a reports the Macro-F1 of ET-BERT, YaTC, and NetMamba on CSTNET-SERVICE under random split with unfrozen fine-tuning, time-based split with unfrozen finetuning, and time-based split with frozen fine-tuning. Under the conventional random-split protocol, all three methods exceed 90% Macro-F1, in agreement with their original reports. However, when the protocol is changed to the timebased split, the Macro-F1 of all three methods drops to roughly 75%. When the backbone is further frozen, all three methods collapse to 20%–50% Macro-F1. This indicates that the high accuracy reported by these raw-bytes pretrained models relies simultaneously on a temporally independent and identically distributed (i.i.d.) test set, which is violated in the real deployment scenario. 4.3

Confirming Temporal Drift via Feature Divergence

We further measure how strongly the train and test sets differ in protocol-level features. For each flow, we extract a set F of protocol-aware features from its packet trace, including flow-level statistics and commonly used fields from IP and TCP headers, TLS records, and TLS handshakes. The complete feature definitions and extraction procedure are provided in the accompanying implementation. For each service class c ∈ C , each feature f ∈ F , and each split protocol s ∈ {time, random}, we estimate the s empirical train and test distributions Pc,f and Qsc,f and 1. The implementation are provided in the supplementary material.

6

0.3

NetMamba

Task: CSTNET-SERVICE

80 60 40

=

x

0.06

0.2

0.05

C1

0.04

C3 C5

0.1

C2

Random split

Time-based Time-based split split frozen finetune

(a) Macro-F1 of prior works on CSTNET-SERVICE under three different settings.

0.0 0.0

0.1

0.2

0.3

Fstab

Packet length, TLS record type, TLS handshake type, and other protocol-structural fields.

Random split mean JS

Fenv

ip.{tos, dsfield, ttl}, tcp.window_size.

Feph

ip.id, tcp.{seq, ack}, tls.handshake.{random, session_id, key_share}, tls.app_data.

(b) Per-class mean Jensen– Shannon divergence Dcs under time-based split versus random split.

quantify their disagreement via the Jensen–Shannon (JS) divergence [47]:
1
s s s s JSc,f = 21 KL Pc,f Mc,f + 2 KL Qsc,f Mc,f , (14) s s where Mc,f = (Pc,f + Qsc,f )/2. Averaging over features P s , gives a service-level drift score Dcs = |F|−1 f ∈F JSc,f and the gap induced by chronological evaluation is

∆c = Dctime − Dcrandom .

(15)

Fig. 3b plots Dctime against Dcrandom for the five service categories. All five lie strictly above the diagonal y = x, i.e. ∆c > 0 for every class. These observations confirm that temporal drift exists in CSTNET-SERVICE and changes the protocol-level features used by the pretrained models. Source of the Degradation

The key limitation of existing raw-byte pretraining methods is their field-agnostic design. These methods directly inherit token- or patch-level objectives from NLP and CV [13]–[15], [21], [22] and apply them uniformly to encrypted traffic bytes. As a result, all sampled bytes are optimized as if they had the same protocol role and temporal stability. In practice, encrypted-traffic fields exhibit heterogeneous statistical properties. For example, a TLS session_id is generated for a specific connection and is therefore essentially random. ip.ttl is coupled to routing and collection environments. And packet length is comparatively stable because it reflects protocol and application-level structure. Motivated by this observation, we partition the feature vocabulary F into three field sets: protocol-structural stable fields Fstab , environment-dependent fields Fenv , and session-specific ephemeral fields Feph . Table 2 summarizes the corresponding assignment within this feature vocabulary. Therefore, an effective encrypted-traffic pretraining method should explicitly account for field heterogeneity. It should exploit stable protocol structure while reducing reliance on environment- and session-specific variation.

5

Included fields

0.03

Fig. 3. Empirical evidence that chronological evaluation is substantially harder than random-split evaluation.

4.4

Field set

C4

20 0

y

Delta JS

Macro-F1 (%)

100

YaTC

Time split mean JS

ET-BERT

TABLE 2 Field sets used for protocol-aware traffic modeling.

# clear features 3 5 7

S TABLE O FFLINE R EPRESENTATION L EARNING

Motivated by the insight in Section 4.4, we propose a protocol-aware pretraining method that handles stable, and

unstable information separately. Our method uses the same encoder as ET-BERT [13] for fair comparison, but with a different pretraining method. It comprises three modules: (i) stable masked language modeling (StableMLM) (Section 5.1), which performs masked reconstruction only on stable fields. (ii) Protocol-aware Contrastive Learning (Section 5.2), which improves the stability of the learned representations. And (iii) Time-Adversarial Module (Section 5.3), which suppresses residual time-correlated information at the representation level. 5.1

Stable Masked Byte Modeling

We use the field sets Fstab , Fenv , and Feph defined in Section 4.4. To connect field-level categories to byte-level inputs, let Ii (S) ⊆ {1, . . . , L} denote the byte positions occupied in xi by fields in a field set S . We attach to each sample xi of length L a stability mask bi = [bi1 , . . . , biL ] ∈ {0, 1}L defined as bij = ⊮[ j ∈ Ii (Fstab ) ] , (16) which means only positions belonging to protocol-structural stable fields are flagged bij = 1. StableMLM performs masked byte reconstruction only on stable positions, so the encoder learns byte-level embeddings from stable protocol structure instead of spending capacity on random content. Given bi , we sample the MLM mask with probability pmask ∈ [0, 1] only over stable positions: mij ∼ Bernoulli(pmask bij ). (17) Masked positions are replaced with a [MASK] token to form the corrupted input x̃i , and the encoder output is fed to a reconstruction head ζψ (·) that predicts the original byte byte byte π̂ij = ζψ (fθ (x̃i )j ) . Here π̂ij denotes the categorical distribution predicted over the byte vocabulary at position byte j of sample i, and π̂ij (xij ) is the probability assigned to the original byte xij . The StableMLM objective is the crossentropy averaged over masked positions in a mini-batch of size B :

1 LSMLM = − PB PL i=1

B X L X

j=1 mij i=1 j=1

byte mij log π̂ij (xij ).

(18) 5.2

Protocol-aware Contrastive Learning

StableMLM teaches the encoder to predict stable bytes from their context, but does not guarantee that the resulting

7

Stage2: Joint Training

Stage1: Warmup 𝑚𝑖𝑗 ∼ Bernoulli 𝑝𝑠𝑖𝑗 [M]

Queue

Contrastive Loss

Representation

Time Adversarial Loss 𝑟𝑖Ƹ = 𝑑𝜙 GRL ℎ𝑖

...

Momentum encoder

[M]

Transform

Encoder

ℱstab

ℱenv

ℱe𝑝ℎ

[cls]

Encoder StableMLM

StableMLM

Representation

𝑚𝑖𝑗 ∼ Bernoulli 𝑝𝑠𝑖𝑗 [M]

[M]

Fig. 4. Overview of the proposed protocol-aware pretraining method.

representation is invariant to changes on unstable fields. We make this invariance explicit through a contrastive objective built on a protocol-aware augmentation. 5.2.0.1 Protocol-aware Transform: The positive view x+ i keeps every stable byte of xi (bij = 1) intact and + redraws unstable fields. Let vi,f and vi,f denote the values of field f in the original sample xi and the augmented view x+ i , respectively. For each session-specific ephemeral field f ∈ Feph , + vi,f ∼ Uniform(Vf ),

(19)

where Vf is the admissible value space of f . For ordinary ephemeral fields, sampling is independent across fields. For stateful ephemeral fields such as tcp.seq and tcp.ack, we instead apply one shared per-flow transformation to all coupled fields to preserve intra-flow consistency. For each environmental field f ∈ Fenv ,

ℱ

ℬstab

ℬenv

ℬe𝑝ℎ

followed by a multilayer perceptron (MLP) projection head denoted by ζq and ζk , respectively, and ℓ2 normalization: ℬe𝑝ℎ ℬenv qiℬstab = norm(ζ q (Pool(f θ (xi )))) ,

ki+ = norm ζk Pool(fθ̄ (x+ i ))

(22)

,

(23)

where Pool(·) is a sequence-pooling operator. To decouple the number of negatives from the batch size, we maintain a first-in first-out queue Q of recently produced keys with capacity |Q|. At each step, the current-batch keys {ki+ }B i=1 are enqueued and the oldest entries are evicted, so Q caches a large negative pool accumulated over many past steps without enlarging the batch. Given a mini-batch of queries {qi }B i=1 , positive keys {ki+ }B i=1 , and the negative keys {kl } in Q, the information noise-contrastive estimation (InfoNCE) loss [50] is B

+ exp(q⊤ 1 X i ki /τ ) log , P + ⊤ B i=1 exp(q⊤ i ki /τ ) + kl ∈Q exp(qi kl /τ ) (24) where τ > 0 is a temperature hyperparameter. Because x+ i differs from xi only on positions in Ii (Feph ∪ Fenv ), minimizing LCL is equivalent to enforcing that the encoder be insensitive to perturbations of ephemeral and environmentdependent bytes, while remaining free to exploit the information carried by Fstab .

LCL = −

+ vi,f ∼ P̂ (vf ),

(20)

+ which means vi,f is sampled from the distribution of field f estimated from the pretraining set. Because fields in Fenv encode both environment-specific statistics and temporal noise, sampling from P̂ (vf ) preserves the former while randomizing the latter. Additionally, checksums that depend on the modified bytes are recomputed and length-related parsing boundaries are kept intact, so x+ i is a syntactically valid sample that differs from xi precisely on Ii (Feph ∪ Fenv ). 5.2.0.2 Contrastive Objective: We feed the transformed pairs into a contrastive objective to obtain a better representation, and instantiate it with the MoCo v2 [48], [49] framework. Under this framework, the encoder fθ trained in StableMLM continues to be updated by back-propagation and plays the role of the query encoder. Additionally, we introduce a momentum encoder fθ̄ that shares the architecture of fθ and whose parameters track θ through an exponential moving average (EMA),

θ̄ ← µ θ̄ + (1 − µ) θ,

µ ∈ [0, 1).

(21)

With µ close to 1, θ̄ evolves slowly, so the keys produced by fθ̄ over many past steps remain mutually consistent and can be reused as negatives. The encoder fθ embeds the original view and fθ̄ embeds the augmented view. Each branch is

5.3

Time-Adversarial Module

The two modules above rely on manually specified protocol priors. As a complement, we add an end-to-end implicit branch that lets the encoder suppress residual timecorrelated information. We linearly normalize the capture time ti of each pretraining sample to t̃i ∈ [0, 1]. Let zi = Pool(fθ (xi )) denote the pooled sequence representation. We route zi through a gradient reversal layer (GRL) [51] into a time-regression head dν (·):

t̂i = dν (GRL(zi )) ,

(25)

and supervise the prediction with a Smooth-ℓ1 loss:

Ltime =

B
1 X SmoothL1 t̂i , t̃i . B i=1

(26)

8

The GRL acts as the identity in the forward pass but reverses the gradient propagated to the encoder during back-propagation. The resulting adversarial objective is

min max Ltime (θ, ν), ν

θ

(27)

where dν learns to recover the capture time, whereas fθ learns to remove time-predictive information from zi . 5.4

Training Pipeline

Both the contrastive objective and the day-regression branch operate on the pooled representation Pool(fθ (·)). If fθ has not yet acquired informative byte-level features, the gradients of both objectives are computed on a representation without discriminative structure and carry little useful signal. We therefore adopt a two-stage pretraining schedule. 5.4.0.1 StableMLM Warm-up: We first optimize LSMLM alone for Tw epochs, so that fθ acquires byte-level embeddings and contextual representations on stable positions, providing an effective initialization for the subsequent two objectives. 5.4.0.2 Joint Training: Starting from the warmedup encoder, all three objectives are optimized jointly for Tj epochs:

Ltotal = LSMLM + λc LCL + λt Ltime ,

(28)

where λc , λt ≥ 0 are loss weights. The complete training procedure is summarized in Algorithm 1. 5.4.0.3 Stage 3: Fine-Tuning: The pretrained encoder fθ is then used directly in the two downstream configurations defined in Section 3, namely the unfrozen and frozen fine-tuning given by (4) and (5).

6

C LOSED -L OOP O NLINE A DAPTATION

Section 5 provides an offline training method that is more robust to temporal drift. A more accurate classifier enables the RAN to select reference rates closer to the true service requirements, thereby improving the QoE of the power allocation in Section 3.2. However, when the deployment distribution drifts severely, the predicted service classes may still deviate from the latent services. The resulting allocation then deviates from the Oracle allocation in (12). This gap motivates a closed-loop online learning framework that uses QoE feedback to adapt the deployed classifier and improve the allocation performance simultaneously. 6.1

Closed-Loop Formulation

Online learning is difficult in deployment because explicit service labels are unavailable. However, QoE feedback ui (pi , ci ) can serve as a weak label. Although it is affected by the wireless channel and the applied allocation, it still reflects whether the selected service treatment matches the latent service. We therefore use QoE-based weak feedback to update the deployed classifier in a closed loop. The closed loop requires two additional information paths. The first path carries the classifier posterior from the core-network inference function to the RAN-side allocation module. In the standard QoS procedure, QFI and 5QI provide the RAN with a hard QoS treatment, whereas online

Algorithm 1 Protocol-aware Pretraining for Time-Drift Encrypted Traffic Classification Require: pretraining set Dpre = {(xi , ti )}; encoder fθ ; MLP heads ζψ , ζq , ζk ; time head dν . 1: // Stage 1: StableMLM warm-up 2: for ι = 1, . . . , Tw do 3: sample {xi }B i=1 ∼ Dpre ; build bi , mi , x̃i via (16)–(17) 4: update (θ, ψ) along ∇LSMLM in (18) 5: end for 6: θ̄ ← θ ; ζk ← ζq ; fill Q with keys produced by fθ̄ 7: // Stage 2: joint pretraining 8: for ι = 1, . . . , Tj do 9: sample {(xi , ti )}B i=1 ∼ Dpre 10: build bi , mi , x̃i via (16)–(17) 11: build positive view x+ i via (19)–(20) 12: compute LSMLM on x̃i via (18) 13: compute qi and ki+ via (22)–(23) 14: compute LCL with negatives in Q via (24) 15: normalize ti to t̃i ∈ [0, 1]; 16: compute t̂i via (25) 17: compute Ltime via (26) 18: Ltotal ← LSMLM + λc LCL + λt Ltime 19: update (θ, ψ, ζq , ν) along ∇Ltotal // GRL flips the sign of ∇θ Ltime 20: θ̄ ← µθ̄+(1−µ)θ; ζk ← µζk +(1−µ)ζq 21: enqueue {ki+ } into Q; evict oldest entries 22: end for 23: // Stage 3: fine-tuning 24: return fθ ; downstream fine-tune via (4) or (5)

adaptation requires posterior confidence over candidate services. We therefore expose ξ cls as a flow-level soft service descriptor. This descriptor can be carried as operator-internal AI/ML control metadata, without changing the user-plane QoS marking or the QFI and 5QI mapping procedure. Although current specifications do not define this posterior as a standard QoS field, its use is consistent with 3GPP AI/ML data-collection studies [52]. The second path provides the feedback required for classifier-head adaptation. The allocation decision is made at the RAN, whereas hϕ is maintained in the core network. Updating hϕ therefore requires the gradient signal induced by RAN-side allocation outcomes. Since current 3GPP QoS and RAN-control interfaces do not specify transport of neural-network gradients, the RAN reports an updateequivalent record from which the core-network learner can reconstruct the objective. The update-equivalent record contains deployment feedback such as QoE measurements and RAN-side execution information. Such records can be collected through multi-access edge computing (MEC) or operations, administration, and maintenance (OAM) datacollection paths [52]–[54]. If model parameters or policy updates are exchanged, they can be handled through 3GPP management-plane AI/ML model management. This design is consistent with 3GPP AI/ML management support for model training, testing, loading, update, and inference reporting [55]. With these two paths, the deployed system can be modeled as an online expected-QoE maximization problem. At

9

Core Network

The aggregate QoE reward varies strongly with service type and channel realization, so we subtract a value-network baseline Vφ (sctx ϕ ) and use the advantage

RAN

Arriving traffic 𝑡𝑗 > 𝑇0

𝑉𝜑

Online Adaptation

MEC/OAM

𝝃cls 𝑥 = softmax ℎ𝜙 𝑓𝜃 𝑥

𝜋𝜔

A = U QoE − Vφ (sctx ϕ ),

𝝃cls

Inference

𝑁 { 𝑔𝑖 𝝃cls 𝑖,𝜙 }𝑖=1 , 𝐩, 𝐽}

normalized to zero mean and unit variance within each rollQoE 2 ) ]. out, where Vφ is trained with Lval = E[(Vφ (sctx ϕ )−U To reuse each rollout under the limited online sample budget, we adopt the proximal policy optimization (PPO) clipped surrogate [58]. Let η(ω, ϕ) denote the importance ratio between the current posterior-dependent policy and the behavior policy stored during rollout collection:

𝑁

max

𝐽 𝜙 𝜔 = 𝔼 ෍ 𝑢𝑖 𝑝𝑖 𝑐𝑖

s. t.

𝑁 𝐩 = 𝒜𝜔 { 𝑔𝑖 𝝃cls 𝑖,𝜙 }𝑖=1 ,

𝜙,𝜔

𝑖=1

𝑁

RRC

෍ 𝑝𝑖 ≤ 𝑃max , 𝑝𝑖 ≥ 0, ∀𝑖 ∈ 𝒩. 𝑖=1

Fig. 5. The online learning framework.

η(ω, ϕ) = each decision epoch, the core-network classifier produces the posterior ξ cls i,ϕ for each active flow, and the RAN observes the wireless state gi . The allocation rule Aω then maps these quantities to a feasible power vector. The joint optimization problem is "N # h i X QoE ui (pi , ci ) max J(ϕ, ω) = E U =E ϕ, ω

s.t.

 i=1  cls N p = Aω {(gi , ξi,ϕ )}i=1 , N X

pi ≤ Pmax ,

pi ≥ 0,

(29)

Policy-Gradient Solution

To solve (29), we instantiate Aω with a stochastic policy πω and optimize its parameters jointly with the classifier head. Since each flow arrival is a single decision without a state transition, we cast the problem as a contextual bandit [56] and solve it by policy gradient. Let γi = log(1 + gi ) and normalize it within each rollout as γ̄i = (γi − µγ )/(σγ + εnorm ), where µγ and σγ are the rollout mean and standard deviation and εnorm > 0 is a small constant. The context state concatenates the normalized log channel gain with the classifier posterior, h i cls sctx = γ̄ , ξ (30) i i,ϕ i,ϕ , ctx ctx and the system context is sctx ϕ = [s1,ϕ , . . . , sN,ϕ ]. The policy ctx outputs Dirichlet concentrations αω (sϕ ) and samples the power allocation

pi = Pmax ρi ,

(31)

which meets the power budget by construction. The RAN executes the sampled allocation and returns a rollout record to the core-network learner. The rollout buffer M stores the context, the sampled power vector, the behavior log probability, the policy version or parameter snapshot, and the measured aggregate QoE reward U QoE . Let πω (p | sctx ϕ ) denote the Dirichlet policy. We maximize the expected reward in (29) by REINFORCE [57], whose policy-gradient component is h i QoE ∇ω J = E ∇ω log πω (p | sctx . (32) ϕ )U

(34)

Lpol = −E[min(η(ω, ϕ) A, clip(η(ω, ϕ), 1 − ϵ, 1 + ϵ) A)] , (35) where ϵ > 0 is the PPO clipping parameter that limits each update to a small trust region. The collected QoE rewards are fixed during the K update epochs. With an entropy regularizer H(πω ) for exploration, the total loss is L = Lpol + λv Lval − λe H(πω ).

i=1

ρ ∼ Dir(αω (sctx ϕ )),

πω (p | sctx ϕ ) . πωold (p | sctx ϕold )

Here ωold and ϕold denote the behavior policy and classifierhead parameters used to collect the rollout.

∀i ∈ N .

This problem is nonconvex because the classifier posterior is nonlinear, and the allocation rule Aω is optimized jointly with this posterior input. 6.2

(33)

(36)

The coefficients λv ≥ 0 and λe ≥ 0 are the weight of the value-function regression term and the entropy regularization term, respectively. Since the context state (30) contains the posterior ξ cls i,ϕ , the core-network learner back-propagates L into the local classifier head when replaying the feedback record and the corresponding policy information. Because the observed QoE reward is corrupted by channel randomness and user-side estimation noise, updating the full encoder could distort the stable representation learned offline. We therefore freeze fθ0 and update only {ω, φ, ϕ}. After each update round, the refreshed policy parameters are synchronized to the RAN-side allocation module through the same management path. Algorithm 2 summarizes the procedure. For implementation, the RAN reports the measured QoE reward, the wireless state , the applied power vector, the behavior log probability through MEC/OAM data-collection paths [52]–[54]. And the policy network parameter updates can be exchanged through management-plane AI/ML model management [55].

7

E XPERIMENTS

7.1

Experimental Setup

Hardware and Implementation. All experiments were conducted on the same Ubuntu 24.04 server using PyTorch 2.8.0 and CUDA 12.8, with a 38-core x86-64 CPU and data-center GPUs, each providing 80 GB of memory and 19.5 TFLOPS peak FP32 performance. Datasets and protocols. We evaluate on CSTNET-APP and CSTNET-SERVICE under the random and time-based splits defined in Section 4.1. For both splits, we report unfrozen and frozen fine-tuning and use classification accuracy (ACC) and Macro-F1 as the main metrics.

10

Algorithm 2 Closed-Loop Bandit Adaptation Require: frozen encoder fθ0 ; classifier head hϕ ; policy πω ; value network Vφ . 1: ωold ← ω ; ϕold ← ϕ 2: for each rollout do 3: initialize rollout buffer M 4: for each online decision epoch in the rollout do 5: obtain classifier posteriors ξ cls i,ϕold for active flows 6: combine the posteriors with channel gains to form sctx ϕold via (30) 7: allocate power p using πωold via (31) and record the behavior log probability and policy version 8: apply p and store the QoE reward, channel gains, applied power, behavior log probability, and policy version or snapshot in M 9: end for 10: compute and normalize advantages in M via (33) 11: for k = 1, . . . , K do 12: recompute current posteriors and states for transitions in M 13: evaluate L via (34)–(36) 14: update {ω, φ, ϕ} along ∇L; keep fθ0 frozen 15: end for 16: synchronize the updated policy parameters ω to the RAN-side allocation module 17: ωold ← ω ; ϕold ← ϕ 18: end for

7.2

Offline Evaluation

The offline pretraining hyperparameters of the proposed method are summarized in Table 3. Our model uses the same encoder architecture as ET-BERT and changes only the pretraining objective. We use AdamW with batch size 32, learning rate 5 × 10−5 , and weight decay 0.02. The learning rate is warmed up from 5 × 10−6 for 10 epochs and then cosine-decayed to 1 × 10−5 over a 50-epoch optimizer schedule. StableMLM is optimized alone for 30 epochs, followed by 50 epochs of joint training. We compare against ET-BERT [13], YaTC [14], and NetMamba [15] using their released weights and official finetuning protocols. ET-BERT is fine-tuned with AdamW for 50 epochs using batch size 32 and learning rate 6 × 10−5 and its classifier learning rate in the frozen setting is 2 × 10−4 . YaTC is fine-tuned with AdamW for 200 epochs using batch size 128 and base learning rate 2 × 10−3 . NetMamba is finetuned with AdamW for 120 epochs using batch size 128 and base learning rate 2 × 10−3 . Time-based split. Table 4 reports the performance comparison under the time-based split. Our method attains the best ACC and Macro-F1 on both datasets and in both fine-tuning settings. On CSTNET-APP, Macro-F1 improves from 38.48%/16.33%/7.41% to 67.89% in the frozen setting and from 69.88%/68.65%/68.28% to 72.14% in the unfrozen setting. On CSTNET-SERVICE, it improves from 50.03%/27.71%/20.75% to 73.02% in the frozen setting and from 74.56%/74.90%/74.54% to 82.19% in the unfrozen setting. The larger gain in the frozen setting indicates stronger transfer under temporal drift. Random split. Table 5 reports the performance com-

TABLE 3 Hyperparameters of the proposed offline method.

Hyperparameter

Value

Mask probability pmask EMA coefficient µ InfoNCE temperature τ MoCo queue capacity |Q| Contrastive loss weight λc Time-adversarial weight λt StableMLM warm-up epochs Tw Joint training epochs Tj

0.3 0.995 0.07 8192 10.0 5.0 30 50

parison under the random split. Our method also leads in this setting. On CSTNET-APP, frozen Macro-F1 increases from 48.31%/24.93%/13.93% to 86.85%, and on CSTNET-SERVICE it increases from 55.12%/27.66%/23.86% to 90.47%. The unfrozen results are best in every column. The result confirms a consistent gain on the i.i.d. benchmark, which means our method is also effective in conventional benchmarks without temporal drift. Ablation study. Table 6 reports the ablation results under the time-based setting. StableMLM alone lifts frozen MacroF1 to 57.34% on CSTNET-APP and 66.48% on CSTNETSERVICE. Adding the contrastive branch raises it to 64.41% and 72.14%, and adding the time-adversarial branch raises it to 60.05% and 69.77%. The full model reaches 67.89% and 73.02%. These results show complementary contributions from the three objectives. Representation visualization. Figure 6 visualizes the pooled encoder outputs with t-distributed stochastic neighbor embedding (t-SNE) for seven randomly selected service classes from the cross-time test split. ET-BERT, YaTC, and NetMamba show overlapping clusters, whereas the full model yields compact class-wise clusters. The ablated models occupy intermediate positions. The five-nearest-neighbor (5-NN) purity further provides a quantitative view of this local structure. For each sample, it counts how many of its five nearest neighbors in the representation space share the same class label. Larger values therefore indicate stronger local class consistency. The baseline distributions are dominated by the 0/5 bin, meaning that most samples have no same-class neighbor among their five nearest neighbors. This suggests that the released pretraining provides limited class separation. By contrast, the full model is concentrated in the 5/5 bin, showing that the proposed pretraining learns locally coherent and class-discriminative representations. The ablation variants perform between the baselines and the full model. Removing either the contrastive or timeadversarial objective reduces high-purity mass, while StableMLM alone also underperforms the full model. These trends confirm complementary contributions from all three pretraining components. 7.3

Online Evaluation

Online setting. The online policy-gradient hyperparameters are summarized in Table 7. The policy and value networks are three-layer MLPs with two 256-neuron hidden layers and rectified linear unit (ReLU) activations. The classifierhead update is sensitive to the learning rate under weak

11

TABLE 4 Performance comparison under the time-based setting.

CSTNET-APP(time-based split) Method

Unfrozen

ET-BERT YaTC NetMamba Ours

CSTNET-SERVICE(time-based split)

Frozen

Unfrozen

Frozen

ACC (%)

Macro-F1 (%)

ACC (%)

Macro-F1 (%)

ACC (%)

Macro-F1 (%)

ACC (%)

Macro-F1 (%)

73.24 72.31 72.47 78.53

69.88 68.65 68.28 72.14

43.12 21.79 10.76 73.56

38.48 16.33 7.41 67.89

77.02 78.55 78.59 83.93

74.56 74.90 74.54 82.19

57.91 44.48 40.16 76.03

50.03 27.71 20.75 73.02

TABLE 5 Performance comparison under the random-based setting.

CSTNET-APP(random split) Method

Unfrozen

ET-BERT YaTC NetMamba Ours

CSTNET-SERVICE(random split)

Frozen

Unfrozen

Frozen

ACC (%)

Macro-F1 (%)

ACC (%)

Macro-F1 (%)

ACC (%)

Macro-F1 (%)

ACC (%)

Macro-F1 (%)

91.52 88.41 89.73 92.25

90.17 86.81 88.21 90.67

53.50 32.49 21.51 88.12

48.31 24.93 13.93 86.85

94.15 90.57 91.63 94.63

93.88 89.49 90.36 94.37

61.91 44.21 40.89 91.35

55.12 27.66 23.86 90.47

TABLE 6 Ablation study under the time-based setting.

CSTNET-APP(time-based split) Method

Unfrozen

Ours Ours w/o Time Adv Ours w/o Contrastive Ours w/o Both

CSTNET-SERVICE(time-based split)

Frozen

Unfrozen

Frozen

ACC (%)

Macro-F1 (%)

ACC (%)

Macro-F1 (%)

ACC (%)

Macro-F1 (%)

ACC (%)

Macro-F1 (%)

78.53 77.14 76.44 79.76

72.14 70.68 71.24 74.67

73.56 69.31 64.12 61.12

67.89 64.41 60.05 57.34

83.93 82.48 84.00 83.70

82.19 79.51 81.97 81.23

76.03 75.42 74.29 71.32

73.02 72.14 69.77 66.48

QoE feedback. Small values yield little adaptation, and large values destabilize training. Hence we set the classifier-head learning rate to 3 × 10−5 for SEROA and ET-BERT, 1 × 10−4 for YaTC, and 3 × 10−4 for NetMamba. TABLE 7 Hyperparameters of the online-learning module.

Hyperparameter Online adaptation episodes Policy/value hidden widths Activation function Multi-step updates K PPO clipping parameter ϵ Value-loss weight λv Entropy weight λe Optimizer Policy/value learning rate Classifier-head learning rate

Value 150 256, 256 ReLU 8 0.2 0.5 0.01 Adam 3 × 10−4 Method-specific

We conduct online evaluation on CSTNET-SERVICE under the time-based split. The post-threshold portion is

randomly divided at a 1:1 ratio into an online adaptation stream and a held-out online test set. In addition to the Macro-F1 on these two portions, we report the Macro-F1 on the original offline-training split to measure forgetting during online adaptation. We consider an urban macrocell single-cell downlink with N = 6 active users, bandwidth W = 10 MHz, total transmit-power budget Pmax = 1 W, and noise power σ 2 = 10−8 . The users are distributed within a 0.05–0.30 km range from the BS. The large-scale fading for user i Li is generated from the urban macrocell path-loss model in 3GPP Technical Report (TR) 36.942 [59]:

Li = 128.1 + 37.6 log10 (di ),

βi = 10−Li /10 ,

(37)

where di is measured in kilometers. The service profiles and reference rates of the five CSTNET-SERVICE categories are given in Table 1. Online comparison. Following Section 6, we freeze the encoder and update the policy network πω , the value network Vφ , and the classifier head hϕ under QoE feedback. ET-BERT, YaTC, NetMamba, and our method use the same RAN online-learning framework and the same reward nor-

12

60

train test

train test

train test

train test

40

40 25

0

0

t-SNE 2

t-SNE 2

t-SNE 2

t-SNE 2

30

0

0 −25 −40

−40

−30 −50 −30

0

30

−60

−30

t-SNE 1

0

30

−25

0

t-SNE 1

(a) ET-BERT

25

50

−30

(b) YaTC

(d) Ours

100

0/5

1/5

0.230

0.354

0.445

2/5

Net Mamba

ETBERT

YaTC

3/5

0.694

4/5

0.744

5/5 0.797

0.843

train test

train test

30

80

0

0

−30

0

60

40

−30

−30

−30

Ratio (%)

0

t-SNE 2

30

t-SNE 2

t-SNE 2

30

t-SNE 1

(c) NetMamba

train test

30

0

t-SNE 1

20

30

−30

0

t-SNE 1

30

−30

60

0

(e) Ours w/o Time Adv

0

30

t-SNE 1

t-SNE 1

(f) Ours w/o Contrastive

(g) Ours w/o Both

Ours w/o Ours w/o Ours w/o both contrastive time adv

Ours

(h) 5-NN Purity

Fig. 6. Representation visualization on the cross-time test split. (a)–(c) are baselines, (d) is the proposed StableMLM+Contrastive+Time-Adversarial method, (e)–(g) ablate one or both components of (d), and (h) reports the 5-NN class purity for all methods.

0.7

40% 20%

37

74

Episode

(a) Reward

111

149

80%

60%

0% −25%

40% 20%

YaTC

0%

0

0% −25%

ΔF1

60%

100%

0

37

NetMamba

75

ET-BERT

112

ours

150

(b) Train Macro-F1

−50%

40% 20%

YaTC

0%

Episode

0%

60%

ΔF1

80%

Macro-F1

Ours Pred-Class ET-BERT Pred-Class Oracle Class-Agnostic

100%

80%

Macro-F1

YaTC NetMamba ET-BERT ours

0.8

100%

ΔF1

0.9

Macro-F1

RL / Oracle

1.0

0

37

NetMamba

75

ET-BERT

112

Episode

(c) Test Macro-F1

ours

YaTC

0% 150

0

37

NetMamba

75

ET-BERT

ours

112

150

Episode

(d) Offline Train Macro-F1

Fig. 7. Online-learning performance initialized from frozen fine-tuning. The reward panel includes online policies and static allocation references; the other panels report online-adaptation Macro-F1, held-out online-test Macro-F1, and offline-training Macro-F1 of the online learners.

malization. The reward also compares the online policies with the static allocation references defined in Section 3.2, including Oracle, Class-Agnostic, and the predicted-class allocations driven by ET-BERT and our method. For comparison, we normalize all reward curves by Oracle. Initialization from frozen fine-tuning. Figure 7 reports the results for models initialized by frozen fine-tuning. In the reward panel, Ours Pred-Class is already well above ETBERT Pred-Class and the Class-Agnostic reference, showing that the frozen representation provides reliable service information for static RAN allocation. The online policy initialized from our method further improves the oraclenormalized reward and moves closer to Oracle. The online rewards of ET-BERT, YaTC, and NetMamba remain close to the Class-Agnostic reference. Our method also maintains the highest held-out online-test Macro-F1 throughout adaptation, whereas the online-test and offline-training Macro-F1 scores of the comparison methods decrease. These curves show that limited representation performance makes the classifier head more susceptible to noisy QoE feedback. Initialization from unfrozen fine-tuning. Figure 8 re-

ports the results for models initialized by unfrozen finetuning. The initial offline classification gap is narrower than in the frozen setting, and both predicted-class references provide competitive static allocation rewards above the Class-Agnostic reference. Our online policy still attains the highest reward and remains closest to Oracle, indicating that QoE-feedback adaptation improves power allocation beyond the fixed predicted-class mapping. Our method also improves the held-out online-test Macro-F1 while preserving its offline-training Macro-F1. The classification curves of the comparison methods degrade during adaptation. These results show that stable representations remain important when online learning relies on noisy QoE feedback. Offline pretraining ablation. Figure 9 evaluates the offline pretraining components under both initialization settings. Adding the contrastive objective to StableMLM substantially improves the reward and held-out online-test Macro-F1. Adding the time-adversarial objective provides a further gain. The same ordering holds for both frozen and unfrozen fine-tuning. These results confirm that robust offline representations improve adaptation under noisy QoE

13

0.7

80%

40% 20% YaTC

0%

0

37

74

111

149

0

0% −25%

NetMamba

37

Episode

60% 40% 20%

ET-BERT

75

ours

112

YaTC

0% 150

0

37

Episode

(a) Reward

0% −25%

NetMamba

75

60% 40%

0%

ΔF1

60%

Macro-F1

100%

80%

ΔF1

Ours Pred-Class ET-BERT Pred-Class Oracle Class-Agnostic

100%

80%

Macro-F1

YaTC NetMamba ET-BERT ours

0.8

100%

ΔF1

0.9

Macro-F1

RL / Oracle

1.0

20% ET-BERT

112

ours

YaTC

0% 150

0

NetMamba

37

Episode

(b) Train Macro-F1

−50%

ET-BERT

75

ours

112

150

Episode

(c) Test Macro-F1

(d) Offline Train Macro-F1

Fig. 8. Online-learning performance initialized from unfrozen fine-tuning. The reward panel includes online policies and static allocation references; the other panels report online-adaptation Macro-F1, held-out online-test Macro-F1, and offline-training Macro-F1 of the online learners.

100%

100%

1.0

ours ours w/o time adv ours w/o both

Oracle Equal

−50%

40%

37

74

111

0.9

0.8

ours ours w/o time adv ours w/o both

20% ours

0%

0

0%

Macro-F1

0.8

80%

60%

RL / Oracle

0.9

ΔF1

Macro-F1

RL / Oracle

80%

149

0

ours w/o time adv

37

Episode

75

ours w/o both

112

40%

37

74

111

149

ours

0

ours w/o time adv

37

Episode

(b) Frozen Test Macro-F1

0% −25%

20% 0%

0

150

Episode

(a) Frozen Reward

Oracle Equal

60% ΔF1

1.0

75

ours w/o both

112

150

Episode

(c) Unfrozen Reward

(d) Unfrozen Test Macro-F1

Fig. 9. Offline pretraining component ablation under frozen and unfrozen fine-tuning. The panels show oracle-normalized reward and held-out online-test Macro-F1.

100%

100%

1.0

0%

40%

ours

0%

37

74

111

Episode

(a) Frozen Reward

0.9 ours ours w/o PPO-Clip ours w/o PPO-Clip & Adv

0.8

20%

0.7 0

5%

149

0

ours w/o PPO-Clip

37

75

ours w/o PPO-Clip & Adv

112

Oracle Equal

5%

60%

ours

0%

0

37

74

111

149

0

ours w/o PPO-Clip

37

Episode

Episode

(b) Frozen Test Macro-F1

0%

40% 20%

0.7

150

Macro-F1

0.8

Oracle Equal

RL / Oracle

ours ours w/o PPO-Clip ours w/o PPO-Clip & Adv

80%

60%

ΔF1

0.9

Macro-F1

RL / Oracle

80%

ΔF1

1.0

75

ours w/o PPO-Clip & Adv

112

150

Episode

(c) Unfrozen Reward

(d) Unfrozen Test Macro-F1

Fig. 10. Online policy-gradient component ablation under frozen and unfrozen fine-tuning. The panels show oracle-normalized reward and held-out online-test Macro-F1.

feedback. Online policy-gradient ablation. Figure 10 evaluates the advantage baseline and PPO clipped surrogate. The full method converges faster and attains the highest reward and held-out online-test Macro-F1 under both initialization settings. Removing PPO clipping reduces performance, while removing the advantage baseline causes a further decline. 7.4

TABLE 8 Pretraining overhead and inference efficiency.

Stage

Params Train/Total

Mem. Time Throughput (GB) (ms/sample) (samples/s)

Baseline pretrain 86.2M/86.2M 5.29 Ours pretrain 86.9M/173.9M 9.81 Inference 86.8M/86.8M 1.00

2.18 4.88 0.64

458.7 205.1 1563.4

Inference Efficiency

To evaluate the computational overhead of the proposed method, we measure pretraining and inference efficiency. Table 8 reports the number of trainable and total parameters, peak memory, per-sample latency, and throughput with batch size 32 on a single GPU. Compared with the baseline pretraining stage, our pretraining requires higher memory and latency because it jointly optimizes StableMLM, contrastive learning and the time-adversarial branch. However, this additional cost is incurred only in the offline stage before deployment and will not influence online inference. At deployment time, the classifier is invoked once for each early-flow sample, and the predicted service class is retained throughout the flow lifetime for QoS mapping and scheduling. Therefore, the deployed classifier does not require per-slot inference. The inference latency is 0.64 ms per sample, corresponding to a throughput of 1563.4 samples/s, which is sufficient for real-time flow-level service iden-

tification in the considered service-aware mobile-network setting.

8

D ISCUSSION AND C ONCLUSION

8.1

Discussion

This paper reports results on the public CSTNET datasets to ensure reproducibility and fair comparison. Beyond this public evaluation, the proposed method has also been tested on a private industrial dataset and deployed with an industrial collaborator. The dataset cannot be released because traffic traces are closely related to user privacy and operational confidentiality, which remains a fundamental constraint in network-trace sharing [60]. Moreover, the current online-learning setting is still simplified. It considers service-aware power allocation with a minimum-rate-oriented QoE utility, while practical RAN

14

optimization may involve additional resource dimensions such as subcarrier assignment and scheduling, together with richer QoE metrics beyond minimum rate [7], [9], [38], [39]. Extending the framework to these settings is left for future work. 8.2

Conclusion

This paper presented a deployment-oriented framework for encrypted traffic classification under temporal drift. The offline component learns stable representations by separating protocol-structural and time-sensitive bytes, combining stable-field masked modeling, protocol-aware contrastive learning, and time-adversarial training. The online component uses feedback records containing QoE, wireless-state, and allocation information to update the classifier head without explicit service labels. Experiments on CSTNET-APP and CSTNET-SERVICE show consistent gains over representative pretrained baselines under random and time-based splits, frozen and unfrozen fine-tuning, and QoE-driven online adaptation. These results show that stable representation learning and label-efficient online adaptation can improve encrypted traffic classification for service-aware mobile networks.

R EFERENCES [1]

3GPP, “Service requirements for the 5G system; Stage 1,” 3rd Generation Partnership Project (3GPP), Technical Specification TS 22.261, version 20.5.0, Release 20, Dec. 2025. [Online]. Available: https://www.3gpp.org/ftp/Specs/archive/22 series/ 22.261/22261-k50.zip [2] 3GPP, “Extended Reality (XR) in 5G,” 3rd Generation Partnership Project (3GPP), Technical Report TR 26.928, version 19.0.0, Release 19, Oct. 2025. [Online]. Available: https://www.3gpp.org/ftp/ Specs/archive/26 series/26.928/26928-j00.zip [3] A. A. Laghari, H. He, K. A. Memon, R. A. Laghari, I. A. Halepoto, and A. Khan, “Quality of experience (QoE) in cloud gaming models: A review,” Multiagent and Grid Systems, vol. 15, no. 3, pp. 289–304, 2019. [4] F. Bronzino, P. Schmitt, S. Ayoubi, G. Martins, R. Teixeira, and N. Feamster, “Inferring streaming video quality from encrypted traffic: Practical models and deployment experience,” Proceedings of the ACM on Measurement and Analysis of Computing Systems, vol. 3, no. 3, pp. 1–25, 2019. [5] 3GPP, “System architecture for the 5G System (5GS); Stage 2,” 3rd Generation Partnership Project (3GPP), Technical Specification TS 23.501, version 20.1.0, Release 20, Mar. 2026. [Online]. Available: https://www.3gpp.org/ftp/Specs/archive/23 series/ 23.501/23501-k10.zip [6] 3GPP, “Policy and charging control framework for the 5G System (5GS); Stage 2,” 3rd Generation Partnership Project (3GPP), Technical Specification TS 23.503, version 20.1.0, Release 20, Mar. 2026. [Online]. Available: https://www.3gpp.org/ftp/ Specs/archive/23 series/23.503/23503-k10.zip [7] I. Sousa, M. P. Queluz, and A. Rodrigues, “A survey on QoEoriented wireless resources scheduling,” Journal of Network and Computer Applications, vol. 158, p. 102594, 2020. [8] B. Ojaghi, F. Adelantado, A. Antonopoulos, and C. Verikoukis, “SlicedRAN: Service-aware network slicing framework for 5G radio access networks,” IEEE Systems Journal, vol. 16, no. 2, pp. 2556–2567, 2022. [9] J. Mei, X. Wang, K. Zheng, G. Boudreau, A. Bin Sediq, and H. Abou-Zeid, “Intelligent radio access network slicing for service provisioning in 6G: A hierarchical deep reinforcement learning approach,” IEEE Transactions on Communications, vol. 69, no. 9, pp. 6063–6078, 2021. [10] Y. Liu, G. Liu, J. Wang, R. Zhang, D. Niyato, G. Sun, Z. Xiong, and Z. Han, “LAMeTA: Intent-aware agentic network optimization via a large AI model-empowered two-stage approach,” IEEE Journal on Selected Areas in Communications, vol. 44, pp. 2462–2478, 2026.

[11] E. Rescorla, “The Transport Layer Security (TLS) Protocol Version 1.3,” RFC 8446, Aug. 2018. [Online]. Available: https://www.rfc-editor.org/info/rfc8446 [12] S. Rezaei and X. Liu, “Deep learning for encrypted traffic classification: An overview,” IEEE Communications Magazine, vol. 57, no. 5, pp. 76–81, 2019. [13] X. Lin, G. Xiong, G. Gou, Z. Li, J. Shi, and J. Yu, “ET-BERT: A contextualized datagram representation with pre-training transformers for encrypted traffic classification,” in Proceedings of the ACM Web Conference 2022, ser. WWW ’22. New York, NY, USA: Association for Computing Machinery, 2022, pp. 633—-642. [Online]. Available: https://doi.org/10.1145/3485447.3512217 [14] R. Zhao, M. Zhan, X. Deng, Y. Wang, Y. Wang, G. Gui, and Z. Xue, “Yet another traffic classifier: A masked autoencoder based traffic transformer with multi-level flow representation,” Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 4, pp. 5420–5427, 2023. [Online]. Available: https://ojs.aaai.org/index.php/AAAI/article/view/25674 [15] T. Wang, X. Xie, W. Wang, C. Wang, Y. Zhao, and Y. Cui, “NetMamba: Efficient network traffic classification via pre-training unidirectional Mamba,” in 2024 IEEE 32nd International Conference on Network Protocols (ICNP), 2024, pp. 1–11. [16] N. Malekghaini, E. Akbari, M. A. Salahuddin, N. Limam, R. Boutaba, B. Mathieu, S. Moteau, and S. Tuffin, “Deep learning for encrypted traffic classification in the face of data drift: An empirical study,” Computer Networks, vol. 225, p. 109648, 2023. [Online]. Available: https://www.sciencedirect. com/science/article/pii/S1389128623000932 [17] Y. Zhao, G. Dettori, M. Boffa, L. Vassio, and M. Mellia, “The sweet danger of sugar: Debunking representation learning for encrypted traffic classification,” in Proceedings of the ACM SIGCOMM 2025 Conference, ser. SIGCOMM ’25. New York, NY, USA: Association for Computing Machinery, 2025, pp. 296—-310. [Online]. Available: https://doi.org/10.1145/3718958.3750498 [18] N. Wickramasinghe, A. Shaghaghi, G. Tsudik, and S. Jha, “SoK: Decoding the enigma of encrypted network traffic classifiers,” in 2025 IEEE Symposium on Security and Privacy (SP), 2025, pp. 1825– 1843. [19] V. F. Taylor, R. Spolaor, M. Conti, and I. Martinovic, “Robust smartphone app identification via encrypted network traffic analysis,” IEEE Transactions on Information Forensics and Security, vol. 13, no. 1, pp. 63–78, 2018. [20] N. Malekghaini, E. Akbari, M. A. Salahuddin, N. Limam, R. Boutaba, B. Mathieu, S. Moteau, and S. Tuffin, “AutoML4ETC: Automated neural architecture search for real-world encrypted traffic classification,” IEEE Transactions on Network and Service Management, vol. 21, no. 3, pp. 2715–2730, 2024. [21] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “BERT: Pre-training of deep bidirectional transformers for language understanding,” in Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. Association for Computational Linguistics, 2019, pp. 4171–4186. [Online]. Available: https://aclanthology.org/N19-1423/ [22] K. He, X. Chen, S. Xie, Y. Li, P. Dollár, and R. Girshick, “Masked autoencoders are scalable vision learners,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022, pp. 16 000–16 009. [23] A. W. Moore and K. Papagiannaki, “Toward the accurate identification of network applications,” in Passive and Active Network Measurement, C. Dovrolis, Ed. Berlin, Heidelberg: Springer Berlin Heidelberg, 2005, pp. 41–54. [24] M. Crotti, M. Dusi, F. Gringoli, and L. Salgarelli, “Traffic classification through simple statistical fingerprinting,” SIGCOMM Comput. Commun. Rev., vol. 37, no. 1, pp. 5—-16, Jan. 2007. [Online]. Available: https://doi.org/10.1145/1198255.1198257 [25] L. Bernaille, R. Teixeira, and K. Salamatian, “Early application identification,” in Proceedings of the 2006 ACM CoNEXT Conference, ser. CoNEXT ’06. New York, NY, USA: Association for Computing Machinery, 2006. [Online]. Available: https: //doi.org/10.1145/1368436.1368445 [26] V. F. Taylor, R. Spolaor, M. Conti, and I. Martinovic, “AppScanner: Automatic fingerprinting of smartphone apps from encrypted network traffic,” in 2016 IEEE European Symposium on Security and Privacy (EuroS&P), 2016, pp. 439–454. [27] M. Lotfollahi, M. Jafari Siavoshani, R. Shirali Hossein Zade, and M. Saberian, “Deep Packet: a novel approach for encrypted traffic

15

classification using deep learning,” Soft Computing, vol. 24, pp. 1999–2012, 2020. [28] S. Rezaei, B. Kroencke, and X. Liu, “Large-scale mobile app identification using deep learning,” IEEE Access, vol. 8, pp. 348–362, 2020. [29] T. Shapira and Y. Shavitt, “FlowPic: A generic representation for encrypted traffic classification and applications identification,” IEEE Transactions on Network and Service Management, vol. 18, no. 2, pp. 1218–1232, 2021. [30] E. Horowicz, T. Shapira, and Y. Shavitt, “A few shots traffic classification with mini-FlowPic augmentations,” in Proceedings of the 22nd ACM Internet Measurement Conference, ser. IMC ’22. New York, NY, USA: Association for Computing Machinery, 2022, pp. 647—-654. [Online]. Available: https: //doi.org/10.1145/3517745.3561436 [31] X.-Y. Chen, L. Han, D.-C. Zhan, and H.-J. Ye, “MIETT: Multi-instance encrypted traffic transformer for encrypted traffic classification,” Proceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 15, pp. 15 922—-15 929, Apr. 2025. [Online]. Available: https://ojs.aaai.org/index.php/AAAI/ article/view/33748 [32] L. Liu, R. Li, Q. Li, M. Hou, Y. Jiang, and M. Xu, “FlowletFormer: Network behavioral semantic aware pre-training model for traffic classification,” 2025. [Online]. Available: https://arxiv.org/abs/2508.19924 [33] S. Cui, X. Han, D. Han, Z. Wang, W. Wang, B. Jiang, B. Liu, and Z. Lu, “FG-SAT: Efficient flow graph for encrypted traffic classification under environment shifts,” IEEE Transactions on Information Forensics and Security, vol. 20, pp. 5326–5339, 2025. [34] Z. Chen, G. Cheng, J. Li, T. Qin, Y. Zhou, and X. Luan, “Driftoriented self-evolving encrypted traffic application classification for actual network environment,” 2025. [Online]. Available: https://arxiv.org/abs/2501.04246 [35] X. Lin, G. Xiong, G. Gou, W. Dong, J. Yu, Z. Li, and W. Xia, “Respond to change with constancy: Instruction-tuning with LLM for Non-I.I.D. network traffic classification,” IEEE Transactions on Information Forensics and Security, vol. 20, pp. 5758–5773, 2025. [36] 3GPP, “NR; NR and NG-RAN Overall Description; Stage 2,” 3rd Generation Partnership Project (3GPP), Technical Specification TS 38.300, version 19.2.0, Release 19, Mar. 2026. [Online]. Available: https://www.3gpp.org/ftp/Specs/archive/38 series/ 38.300/38300-j20.zip [37] X. Fei, P. Martins, and J. Lu, “Real-time traffic classification for 5G NSA encrypted data flows with physical channel records,” in 2023 IEEE 98th Vehicular Technology Conference (VTC2023-Fall), 2023, pp. 1–6. [38] A. Elgabli, A. Elghariani, V. Aggarwal, and M. Bell, “QoE-aware resource allocation for small cells,” in 2018 IEEE Global Communications Conference (GLOBECOM), 2018, pp. 1–6. [39] M. Polese, L. Bonati, S. D’Oro, S. Basagni, and T. Melodia, “ColORAN: Developing machine learning-based xApps for open RAN closed-loop control on programmable experimental platforms,” IEEE Transactions on Mobile Computing, vol. 22, no. 10, pp. 5787– 5800, 2023. [40] G. Dimopoulos, I. Leontiadis, P. Barlet-Ros, and K. Papagiannaki, “Measuring video QoE from encrypted traffic,” in Proceedings of the 2016 ACM Internet Measurement Conference, ser. IMC. ACM, 2016, pp. 513–526. [41] A. Goldsmith, Wireless Communications. Cambridge University Press, 2005. [42] P. Reichl, S. Egger, R. Schatz, and A. D’Alconzo, “The logarithmic nature of QoE and the role of the Weber-Fechner law in QoE assessment,” in 2010 IEEE International Conference on Communications, 2010, pp. 1–5. [43] 3GPP, “Evolved Universal Terrestrial Radio Access (E-UTRA) and NR; Multi-connectivity; Overall Description; Stage 2,” 3rd Generation Partnership Project (3GPP), Technical Specification TS 37.340, version 19.0.0, Release 19, Sep. 2025. [Online]. Available: https://www.3gpp.org/ftp/Specs/archive/37 series/ 37.340/37340-j00.zip [44] ITU-T, “End-user Multimedia QoS Categories,” International Telecommunication Union, Recommendation G.1010, Nov. 2001. [Online]. Available: https://www.itu.int/rec/T-REC-G. 1010-200111-I/en [45] Apple Inc., “HTTP Live Streaming (HLS) Authoring Specification for Apple Devices,” https:// developer.apple.com/documentation/http-live-streaming/

hls-authoring-specification-for-apple-devices, accessed: Jun. 1, 2026. [46] S. Shalunov, G. Hazel, J. Iyengar, and M. Kuehlewind, “Low Extra Delay Background Transport (LEDBAT),” Internet Engineering Task Force, RFC 6817, Dec. 2012. [Online]. Available: https://www.rfc-editor.org/rfc/rfc6817 [47] J. Lin, “Divergence measures based on the shannon entropy,” IEEE Transactions on Information Theory, vol. 37, no. 1, pp. 145–151, 1991. [48] K. He, H. Fan, Y. Wu, S. Xie, and R. Girshick, “Momentum contrast for unsupervised visual representation learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 9729–9738. [49] X. Chen, H. Fan, R. Girshick, and K. He, “Improved baselines with momentum contrastive learning,” 2020. [Online]. Available: https://arxiv.org/abs/2003.04297 [50] A. v. d. Oord, Y. Li, and O. Vinyals, “Representation learning with contrastive predictive coding,” 2018. [Online]. Available: https://arxiv.org/abs/1807.03748 [51] Y. Ganin, E. Ustinova, H. Ajakan, P. Germain, H. Larochelle, F. Laviolette, M. Marchand, and V. Lempitsky, “Domainadversarial training of neural networks,” Journal of Machine Learning Research, vol. 17, no. 59, pp. 1–35, 2016. [Online]. Available: https://jmlr.org/papers/v17/15-239.html [52] 3GPP, “Evolved Universal Terrestrial Radio Access (E-UTRA) and NR; Study on enhancement for Data Collection for NR and EN-DC,” 3rd Generation Partnership Project (3GPP), Technical Report TR 37.817, version 17.0.0, Release 17, Apr. 2022. [Online]. Available: https://www.3gpp.org/ftp/Specs/archive/37 series/ 37.817/37817-h00.zip [53] 3GPP, “Quality of Experience (QoE) measurement collection; Control and configuration,” 3rd Generation Partnership Project (3GPP), Technical Specification TS 28.405, version 19.0.0, Release 19, Jun. 2024. [Online]. Available: https://www.3gpp.org/ftp/ Specs/archive/28 series/28.405/28405-j00.zip [54] ETSI, “Multi-access Edge Computing (MEC); Radio Network Information API,” European Telecommunications Standards Institute (ETSI), Group Specification ETSI GS MEC 012, 2019, version 2.1.1. [Online]. Available: https://www.etsi.org/deliver/etsi gs/ MEC/001 099/012/02.01.01 60/gs MEC012v020101p.pdf [55] 3GPP, “Management and orchestration; Artificial Intelligence / Machine Learning (AI/ML) management,” 3rd Generation Partnership Project (3GPP), Technical Specification TS 28.105, version 19.5.0, Release 19, Mar. 2026. [Online]. Available: https://www.3gpp.org/ftp/Specs/archive/28 series/ 28.105/28105-j50.zip [56] L. Li, W. Chu, J. Langford, and R. E. Schapire, “A contextualbandit approach to personalized news article recommendation,” in Proceedings of the 19th International Conference on World Wide Web. ACM, 2010, pp. 661–670. [Online]. Available: https://doi.org/10.1145/1772690.1772758 [57] R. J. Williams, “Simple statistical gradient-following algorithms for connectionist reinforcement learning,” Machine Learning, vol. 8, no. 3-4, pp. 229–256, May 1992. [Online]. Available: https://doi.org/10.1007/BF00992696 [58] J. Schulman, F. Wolski, P. Dhariwal, A. Radford, and O. Klimov, “Proximal policy optimization algorithms,” 2017. [Online]. Available: https://arxiv.org/abs/1707.06347 [59] 3GPP, “Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Frequency (RF) system scenarios,” 3rd Generation Partnership Project (3GPP), Technical Report TR 36.942, version 17.0.0, Release 17, Mar. 2022. [Online]. Available: https://www. 3gpp.org/ftp/Specs/archive/36 series/36.942/36942-h00.zip [60] M. Mohammady, M. Oqaily, B. Wadhwa, Y. Hong, D. Lin, H. V. Poor, and R. Dowsley, “A multi-view approach to preserve privacy and utility in network trace anonymization,” ACM Transactions on Privacy and Security, vol. 24, no. 3, pp. 1–36, 2021.

Related documents

• Resource-based online orchestration for multi-domain collaborative analysis of network encrypted traffic#130594
• Inside Crypter-as-a-Service: An Ecosystem Analysis of the exploit.in Underground Forum Research Talks#303154
• Crypto-Agility Requirements for Remote Authentication Dial-In User Service (RADIUS)#501522
• HideOut - User Protection Against Localization with Throughput Guarantees in Mobile Networks#1535643
• Beyond Classification Accuracy: Quantifying Fingerprint Complexity in Encrypted Darknet Services#1061999