## Appendix A Local Feature  
Network traffic classification methods usually depend on many data packets' statistical and sequential features. Although this approach guarantees high classification accuracy, it is often time consuming as it requires processing the many traffic data. In practical applications like network security and traffic management, rapid traffic identification is essential, and the reducing of classification time is a critical issue.  
Recent studies have proposed classifying network traffic based on early packets to address this challenge, extracting features from only the initial few packets of a session (excluding the three-way handshake) [55]. However, these methods face two main limitations. First, they must explain why early packets are sufficient for traffic classification.  
Second, they need more insight into the performance differences between early-packet and full-packet classification regarding statistical and sequential features, constraining the further development of early-packet-based techniques.  
Our work aims to bridge these gaps by thoroughly analyzing the feature variations at different session stages across multiple datasets. It focuses on the statistical and sequential feature differences between early packets and total traffic, demonstrating how features from early packets can effectively distinguish among application types in a session's initial phase. Additionally, it examines the impact of these differences on classification performance. Our analysis sampled a specific traffic type from the ISCX VPN-nonVPN dataset, calculating statistical features for both early packets and the entire packet sequence, as shown in Tables 10 and 11.  
* Flow Duration: In the early stage of flow, VPN chat apps have a wide flow duration range (0.14-30 s), while other apps like chat, email, and FTP are steadier. For all packets, overall differences narrow, but VPN chat has more internal changes due to encryption.
* Data Transmission Rate: In the early stage of streaming, streaming apps transmit data at a speed of approximately 22 MB/s, which is much higher than that of email (40 KB/s) and FTP (19 KB/s). In the middle stage of streaming, the rate differences between FTP and torrent apps narrow, while chat apps maintain a relatively high rate.  
* Packet Size: In the early stage of streaming, the average packet length of streaming apps is about 200 bytes, and the packet size range of file-transfer apps is quite wide. As time goes by, the differences in packet size among different apps increase, as is the case with email apps.
* Inter-Arrival Time: In the early stage of streaming, file-transfer apps have the shortest packet inter-arrival time (about 0.0005 s), and the inter-arrival time of VPN chat appsfluctuates. During the entire session, for apps like VOIP, the inter-arrival time within the app also varies.  
In summary, early packet features help quickly identify app types as they reflect initial traits. On the other hand, all-packet features capture apps' dynamic behaviors over time to understand their patterns.  
The features of early packets accurately reflect the initial transmission characteristics, making them ideal for quickly identifying applications. In contrast, the features derived from all packets capture the dynamic behaviors of applications over time, making them more suitable for recognizing application behaviors.