With the widespread adoption of encryption protocols, payload-based traffic analysis has become increasingly infeasible, posing significant challenges for intrusion detection systems (IDS). Consequently, AI-based approaches for encrypted traffic analysis have gained substantial attention. However, existing studies are often evaluated using inconsistent criteria, including heterogeneous attack labels, behavioral representations, and model architectures, making systematic comparison difficult. To address this limitation, this paper proposes a three-level analytical taxonomy for encrypted traffic analysis, structured around attack objectives (Level 1), observable network behaviors (Level 2), and detection models (Level 3). The proposed framework provides a structured perspective for analyzing how detection objectives, behavioral abstractions, and model design interact under encryption constraints. Based on a systematic analysis of 53 representative studies, this survey examines the relationship between attack objectives, behavior patterns, datasets, evaluation metrics, and AI-based detection models. The analysis indicates that behavioral patterns play an important role in connecting attack objectives with detection models, while also revealing imbalances in the coverage of attack objectives across existing studies. In addition, the survey highlights how dataset selection and evaluation criteria influence the interpretation of model performance in encrypted traffic analysis. Overall, the proposed taxonomy provides a behavior-centric analytical framework for organizing existing encrypted traffic analysis studies and offers insights for future IDS research in encrypted network environments.

Future mobile Internet and convergence applications increasingly rely on encrypted protocols, making security monitoring difficult because payload inspection is unavailable while traffic classes and threats evolve continuously. Encrypted traffic classification models must therefore adapt to newly emerging traffic classes without repeatedly overwriting or fully retraining large Transformer backbones. This study presents and extends an ET-BERT Adapter Fusion framework for AI/ML-driven encrypted-traffic security monitoring in future mobile Internet and convergence applications. The framework keeps the ET-BERT backbone frozen, trains a Base Adapter on USTC-TFC2016 classes 0–9, trains an Incremental Adapter for class 10, and composes them through Adapter Fusion. Across three seeds, Adapter Fusion in the core USTC-TFC2016 10 + 1 setting reached 0.9947 Macro-F1, close to Full Fine-Tuning (0.9978) and Consolidated Adapter training on classes 0–10 (0.9967), while preserving a modular update structure. A controlled Fusion Boundary study over 2–11 fused adapters showed a limited decrease in Macro-F1 from 0.9947 to 0.9681 rather than an abrupt collapse. Consolidated Adapter capacity experiments showed strong USTC-TFC2016 performance up to 20 classes and a clearer scale-dependent decline on CSTNET-TLS 1.3 from 0.9238 Macro-F1 at 10 classes to 0.7944 at 120 classes. Latency measurements further show that Adapter Fusion has higher inference overhead than Full Fine-Tuning and single-adapter alternatives. The conclusion is therefore not that Adapter Fusion is universally faster or more accurate, but that it offers a modular continual-adaptation regime for AI/ML-driven security in future mobile Internet and convergence applications, with benefits and limitations that depend on adapter count, data availability, and deployment constraints.