New classes in seconds, without retraining

A research note from the Adaptive AI Lab — classification by retrieval adds new encrypted-traffic classes without retraining, and detects unknown traffic in the same step.

Research note · September 2026 · Encrypted Traffic

Encrypted traffic classification

Most traffic classifiers become expensive to maintain when applications and threats change: every new application means collecting data, retraining, and redeploying the model. Classification by retrieval takes a different path — it stores compact flow representations and learns a new class by adding a few labeled examples to the index. No retraining run, no downtime.

The same nearest-neighbor distance that assigns a class also tells us when traffic belongs to none of the known classes, so out-of-distribution detection comes from the same retrieval step — a practical answer to zero-day and previously unseen traffic.

Read the Computer Networks paper → · Explore the encrypted-traffic project →

← All research notes