# TransECA-Net: A Transformer-Based Model for Encrypted Traffic Classification
## 4 Experimental Result
### Basic Experiment  
This paper proposes an encrypted network traffic classification method based on CNN-ECANet + Transformer, using the publicly available ISCX VPN-nonVPN dataset [27] for experimental tasks. The dataset consists of raw PCAP files, which, after preprocessing, are divided into individual flows and sessions and then converted into IDX files in the form of 28 \(\times\) 28 \(\times\) 1 pixel images for training. During the training process, we randomly \begin{table}
\begin{tabular}{c c} \hline \hline
**Traffic** & **VPN-Traffic** \\ \hline Browsing & VPN-Browsing \\ Email & VPN-Email \\ Chat & VPN-Chat \\ Streaming & VPN-Streaming \\ File transfer & VPN-File transfer \\ VoIP & VPN-VoIP \\ TraP2P & VPN-TraP2P \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Labeled ISCX VPN-nonVPN dataset. selected \(1/10\) of the total data as test data (i.e., the test set), while the remaining 9/10 of the data was used for training (i.e., the training set). Throughout the training phase, the model parameters were optimized through 10-fold cross-validation. To evaluate the proposed method, the experiments were conducted on a device equipped with an AMD Ryzen 5 5600H processor with Radeon Graphics (3.30 GHz), 16 GB of RAM, and an NVIDIA GeForce 3050 Ti GPU, running Microsoft Windows 11 (64-bit). (Detailed device specifications and the operating environment are shown in Table 3.) The experiments utilized the open-source machine learning library PyTorch 3.9. As a widely used deep learning framework, PyTorch offers a rich collection of pretrained models and components, which can accelerate the development process of encrypted network traffic classification models. Additionally, it provides a variety of debugging tools and visualization libraries that help users better understand and analyze model behavior, offering advantages in debugging and visualization. Finally, PyTorch natively supports GPU-accelerated computation, fully leveraging the parallel computing capabilities of the GPU to speed up model training and inference. In encrypted network traffic classification tasks, where large datasets and complex models often need to be processed, GPU acceleration can significantly enhance computational efficiency. During the model training phase, this study employs cross-entropy loss, the AdamW optimizer [28], and data augmentation techniques [29]. For each training sample, the model generates a predicted probability distribution, representing the likelihood that the sample belongs to each category. The true label indicates the actual class of the sample. Cross-entropy loss is used to measure the difference between the model's predictions and the true labels, and the model's parameters are optimized by minimizing this difference. The AdamW optimizer, introduced by [PERSON] and [PERSON] in their 2017 paper \"Decoupled Weight Decay Regularization\" [30], is an improvement over the traditional Adam optimizer. In this experiment, we opted for the more efficient AdamW optimizer instead of the conventional SGD or Adam optimizers. AdamW combines the benefits of both RMSprop and Momentum by calculating the exponentially moving average of gradients and adjusting the learning rate for each parameter based on unbiased estimates of these averages. It also resolves the issue of weight decay being coupled with gradient updates, which is a known limitation of the Adam optimizer. Numerous deep learning tasks have shown that AdamW outperforms traditional SGD and Adam optimizers, providing more stable training and better generalization, particularly in tasks involving weight decay. Data augmentation plays a key role in the training process by expanding the dataset. By applying various transformations (such as rotation, scaling, cropping, etc.) to the training data, the technique effectively increases the size of the dataset, which enhances the model's robustness and performance. In this study, network traffic data is transformed into a two-dimensional matrix (represented as 28 \(\times\) 28 image-like data).