Two Heads Are Not Better Than One: Continual Learning from Multiple Models for Encrypted Traffic Analysis

Encrypted Traffic Analysis (ETA) is a critical area of research for security monitoring in modern networks. Although machine learning- and deep learning-based ETA methods have shown significant promise, they depend heavily on large-scale, manually labeled data. Meanwhile, the research community has released many high-performing ETA models. However, the knowledge embedded in these models remains siloed and difficult to reuse, as they are trained on heterogeneous feature spaces and task semantics. In practice, such models are typically developed independently at different times. Consequently, a unified model cannot be jointly learned from all existing models. Instead, it should learn each model’s knowledge sequentially as it becomes available. These observations raise a key question: Can we construct a unified model that continually learns from multiple existing models? To address this problem, we propose the Dual-Branch Continual Learning (DBCL) framework, which enables a single large language model (LLM)-based student model to continually learn from multiple task-specific teacher models using teacher-generated predictions rather than raw labeled data. DBCL represents heterogeneous traffic features and task semantics in a shared semantic space and mitigates catastrophic forgetting via a dual-branch architecture that balances rapid knowledge acquisition with long-term retention. Experiments across four publicly available datasets of encrypted traffic demonstrate that DBCL consistently outperforms competitive continual learning baselines. Furthermore, we provide information-theoretic and optimization-theoretic analyses that offer insights into the effectiveness of DBCL, highlighting its potential as a promising ETA approach.