TP-Net: Self-Supervised Pretrained Network Traffic Representations for Few-Shot Threat Detection in IoT and Sensor Networks

Encrypted traffic now dominates IoT and sensor networks, and fully supervised classifiers are bottlenecked by label scarcity and the retraining cost of recognizing new attacks at the resource-constrained edge. TP-Net (Traffic Pretraining Network) couples self-supervised contrastive pretraining with N-way K-shot evaluation: a four-branch 1D-CNN encoder is trained once under SimCLR on packet, burst, flow-statistical, and TLS-handshake features with five traffic-specific augmentations, and it is then frozen at deployment. Our contributions are threefold. First, we build a protocol-fair benchmark that evaluates six supervised-traffic baselines and TP-Net under the same per-episode linear head with a frozen encoder, showing that TP-Net’s SSL encoder stays competitive, trailing the strongest fully trained supervised model by at most 9.75 pp, without any encoder fine-tuning while supervised baselines require retraining. Second, we demonstrate novel-class and encrypted-only generalization, reaching 99.3%/72.9% on unseen novel attacks (CIC two-way/USTC five-way; ISCX’s one-way split is trivial and excluded) and +28.66 pp over no pretrain on fully encrypted DoHBrw-2020 traffic. Third, we show that augmentation strength must adapt to task complexity, overturning the canonical SimCLR stronger-is-better rule on IoT traffic. TP-Net lifts five-shot accuracy over a random encoder by +13.14/+7.76/+4.11 pp and yields a 5-alert, no-finetune, hour-level deployment path for novel encrypted attacks at the edge.