Two Heads Are Better Than One: Models-to-Model Learning for Encrypted Traffic Analysis

Encrypted traffic analysis (ETA) plays a critical role in detecting malicious activities. Although machine learningbased ETA has shown significant promise, existing methods heavily depend on large-scale, manually labeled data. Meanwhile, the research community has released numerous publicly available encrypted traffic datasets, as well as many high-performing ETA models. However, the knowledge embedded in these models remains isolated and cannot be directly leveraged by existing approaches. These observations raise a key question: Can we construct a unified model that learns directly from existing ETA models to perform effective ETA, without relying on manually labeled data? Existing paradigms, such as ensemble learning and knowledge distillation, are unable to meet this goal because they struggle with heterogeneous feature spaces and conflicting model predictions. To address these challenges, we propose the Models-to-Model Learning (M2ML) paradigm, guided by two principles: (1) Knowledge Semantization, which aligns heterogeneous traffic feature spaces into a unified semantic representation; and (2) Credibility-First Arbitration, which resolves inconsistencies among teacher models through their credibility and inter-model consensus. We develop an M2ML framework utilizing a large language model, incorporating Feature-Negative Entropy Injection and Consensus Credibility-Weighted Arbitration to operationalize these principles. Experiments on three publicly available encrypted traffic datasets demonstrate that the M2ML framework eliminates the need for manually labeled data and achieves accuracy surpassing that of the best teacher model. An analysis grounded in information-theoretic principles explains its effectiveness, confirming the M2ML paradigm as a promising paradigm for label-free ETA.