Tor's nested encrypted relay encapsulation effectively defeats byte-level self-supervised classifiers: AlignTraffic achieves only 25.78% Macro-F1 on Tor-tunneled traffic (ISCX-Tor), compared to 83.92% on direct TLS traffic (ISCX-Direct), because Tor's encrypted cells conceal inner application protocol structure from an observer of the outer connection.

Network 5-tuple identifiers (IP addresses, ports) dramatically inflate encrypted traffic classifier accuracy when not masked: retaining these identifiers raises ET-BERT's Macro-F1 on CSTNET from 60.04% to 85.23% and YaTC's from 74.42% to 92.92%, because many 5-tuples are application-exclusive and bypass the need to learn protocol semantics.

§II.B, Figure 2 detection

AlignTraffic, a cross-view contrastive self-supervised model, outperforms shallow classifiers by 5.97 to 30.70 Macro-F1 percentage points across four public encrypted-traffic classification tasks after fine-tuning, and achieves 94.54% accuracy and 51.26% Macro-F1 on an industrial dataset of 165 applications comprising ~4.2 million samples collected March 2025–March 2026, with geographic transfer to held-out regions (Beijing, Xi'an) showing 4.74 pp improvement over the industrial baseline without retraining.

§V.B, Tables IV–V, §V.E, Tables VII–VIII evaluation

Classification-relevant information in TLS traffic is concentrated in the first retained packet's visible protocol fields (TLS ServerHello and handshake metadata), not ciphertext. Shuffling only the first packet's payload reduces AlignTraffic accuracy on CSTNET from 90.35% to 61.14% — near the random-payload baseline of 60.63% — while shuffling only the subsequent four packets' payloads yields 89.04%, close to baseline.

§III.B, Table II detection

Packet-level classification without flow context is significantly harder for self-supervised models: on CSTNET packet-level evaluation, shallow learning achieves 63.73% Macro-F1 while AlignTraffic reaches only 24.97%, because individual encrypted-payload packets carry minimal application-identifying information once the initial handshake is excluded.

§VI.B, Table XI evaluation

Stage 1 of the detection pipeline uses a lightweight heuristic: restrict analysis to IP addresses in "VPS-dense ASNs," which censors already target for resource-intensive inspection of fully-encrypted traffic. This pre-filter dramatically reduces the search space before applying the more expensive dual-role behavioral analysis. The evaluation was conducted without Stages 1 and 3 due to dataset limitations, meaning the reported 23% recall and 0.18% FPR are conservative lower bounds on the full pipeline's performance.

2026-almutairi-server §2.1, §2.2, §3.4 fully-encrypted-detectdpiml-classifier

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

2026-anon-2026-27-vpn §8 (InterSecLab / WIRED section) dpiml-classifierfully-encrypted-detecttraffic-shape

Adversarial pre-padding — prepending stochastic byte noise to packets — degrades ET-BERT encrypted traffic classification accuracy from >99% to 25.68%, exposing a structural vulnerability in all payload-byte-dependent detection systems. White-box adversarial attacks (Ayaka AH-MSI) additionally achieve evasion rates exceeding 99.5% against standard continuous-time sequence models via Manifold Shattering, where adversaries align malicious temporal distributions with benign baselines.

2026-ferrel-aegis-adversarial-entropy-guided §II, §VI-A dpiml-classifier

Explicitly disentangling packet headers (structured, low-entropy) from encrypted payloads (high-entropy, stochastic) into separate MoE branches yields consistent gains across six datasets: 86.85% F1 on 120-class TLS 1.3 traffic (CSTNET-TLS), 97.88% F1 on USTC-TFC2016 malware/benign flows, and 92.65% F1 on imbalanced IoT traffic (CIC-IoT2022), demonstrating that headers and payloads carry fundamentally different and independently exploitable discriminative signals.

2026-he-trafficmoe-heterogeneity-aware-mixture §III-A, §IV-B, Tables II–III ml-classifierdpifully-encrypted-detect

Striding with factor 4 (early downsampling) produces the largest single-factor degradation in the ablation study: average macro-F1 drops from 0.9909 to 0.9772 and cross-dataset variance increases from 4.77×10⁻⁵ to 4.51×10⁻⁴, with worst-case dataset performance falling to MIN 0.9524. Fine-grained byte order and short-range structure — protocol headers, payload signatures, repeated byte motifs — carry essential discriminative signal that stride-based aggregation destroys. This is a far larger degradation than any other design choice tested, including Mamba-1 versus Mamba-2.

2026-kulatilleke-mambanetburst-direct-byte-level §V-B, Table IV ml-classifierdpi

A burst of just 5 packets truncated to 320 bytes each (1600 bytes total) suffices for macro-F1 ≥0.9824 across all six benchmarks; the classification token reads from the final recurrent state after a 4-layer Mamba-2 stack processing this fixed-length prefix, with no additional flow-level or session-level context required.

2026-kulatilleke-mambanetburst-direct-byte-level §III-A, §V-A ml-classifierdpi