PERO: Efficient Robust Post-Training Foundation Models for Encrypted Traffic Classification

2026-08-15

AI Summary

This study addresses the challenge of balancing robustness and computational efficiency during the post-training of encrypted traffic foundation models. We propose PERo, a Pre-evaluation Robust Optimization framework that introduces a novel pre-evaluation mechanism to decouple risk estimation from expensive large-model optimization. By leveraging a lightweight proxy model to estimate sample risks and select high-risk subsets, PERo significantly reduces both computational and memory overhead. Experiments on representative encrypted traffic datasets demonstrate that PERo achieves superior or comparable robustness and average performance relative to existing methods at substantially lower computational costs. Consequently, this work establishes a new paradigm for efficient and robust post-training in encrypted traffic analysis, effectively resolving the trade-off between model resilience and resource consumption in foundation model adaptation.

Abstract

Encrypted traffic classification is vital for network security, yet real-world deployments are inherently sensitive to rare but high-loss errors such as misclassification of malicious traffic. The encrypted traffic foundation model, as a promising general-purpose technique, can achieve impressive overall performance. However, employing standard objectives such as empirical risk minimization often overlooks high-risk tail events, and commonly used performance metrics hardly reflect robustness limitations in risk-sensitive scenarios. Directly applying robust optimization objectives, such as conditional value-at-risk, to post-training is computationally prohibitive for large models, as identifying high-loss samples exhausts substantial computation. To this end, we propose Pre-Evaluation Robust Optimization (PERO), an efficient robust post-training framework for encrypted traffic foundation models. PERO employs a lightweight proxy to estimate sample-wise risk and selects a subset of high-risk samples to update the foundation model, decoupling risk estimation from expensive large-model optimization. Extensive experiments on typical encrypted traffic datasets show that PERO achieves competitive or superior robustness and average performance compared to outstanding robust post-training methods, while significantly reducing computational and memory costs.

Problem

• Encrypted Traffic Classification
• Foundation Models
• Robust Post-Training
• Tail Risk
• Computational Efficiency

Innovation

• Robust Post-Training
• Encrypted Traffic Classification
• Pre-Evaluation Robust Optimization
• Lightweight Proxy
• Risk Decoupling