ProtoSPM: Protocol-Structured Pretraining for Encoder Reuse in Encrypted Traffic Classification

Abstract Reusable traffic representations can reduce repeated encoder training as application and website labels change. Existing methods commonly pretrain on unlabeled traffic and fine-tune the entire model using labeled data. However, full-model fine-tuning updates the encoder using task-specific labels, making it difficult to isolate the reusability of pretrained representations. We investigate how unlabeled traffic can yield a shared encoder that balances representation quality and model size while supporting different classification tasks without backbone updates. We propose ProtoSPM, a parameter-efficient pretraining model guided by protocol structure. It represents bidirectional flows as protocol-field matrices and learns traffic context through masked reconstruction. Type-aware embeddings, protocol-group temporal convolution, hierarchical field attention, and field-relation biases incorporate value semantics, local packet dynamics, and protocol dependencies into a compact encoder. After pretraining on unlabeled backbone-network traffic, the same encoder remains fixed while separate task heads are trained. On ISCX-VPN-app, TLS-120, and CipherSpectrum, the 12.03M-parameter model achieves macro-averaged F1 (Macro-F1) scores of 61.29±1.54%, 67.98±1.23%, and 71.28±1.20%, respectively. These scores exceed a same-input, near-parameter-matched plain field Transformer by 2.13-26.65 percentage points. The results show that ProtoSPM learns useful shared representations from unlabeled traffic and supports adaptation to different classification label spaces without updating encoder weights.