SimCMTC: A Similarity Comparison-Driven Method for Mobile App Encrypted Traffic Classification

Classification of encrypted mobile-app traffic faces three intertwined challenges in open, dynamic environments: label contamination from third-party SDKs, traffic drift caused by app updates, and open-set classes that training cannot cover. We propose SimCMTC, a similarity comparison-driven framework that reformulates classification as a “retrieval + comparison analysis” task. Its core is CMTE, a general embedding model for encrypted mobile-app traffic that learns reusable TCP session representations through large-scale self-supervised pretraining. For unknown traffic, SimCMTC retrieves the most similar labeled samples from a reference vector store and jointly considers vector similarity and nDPI metadata similarity to yield interpretable, open-set-aware predictions. Across five datasets spanning the mobile Internet of China, Iran, and Iraq, CMTE achieves the best closed-set accuracy and F1, and attains Acc/F1 of 0.910/0.898 on TENAPP under fine-tuning-free Top-1 retrieval, approaching the strongest supervised baseline.