## 4 Experiment
### Experimental Set Up
#### 4.1.2 Benchmark Test Dataset  
To verify the effectiveness of the method proposed in Section 3 and its ability to perform multi-granularity classification well, we selected the following datasets for experiments, which included multi-classification tasks: protocol classification (ICSC Dataset), user behavior classification (ISCX dataset), and intrusion detection (MQTT-IDS). It should be noted that only MQTT-IDS pertains to binary classification. In contrast, the remaining datasets are involved in multi-class classification tasks:  
* Self-established industrial control dataset (ICSC Dataset)  
The industrial control Internet has high requirements for the time of network protocol classification. In this paper, the dataset established by [PERSON] et al. in 2020 [40] is used. In addition, following their method, we supplement some traffic data of ICS protocols based on the original dataset. The supplementary data include the benign part of the following sites from 2020 to 2025: Netresec [41], TriStation [42], AWS Cloud [43], NREL [44], ITHACA [45], the Electra power system control traffic dataset [46], IEC datasets [47], and the Modbus dataset from CEST16 [48]. These sources provided updated industrial control network traffic data from 2020 to 2025. The dataset includes both annotated and unannotated traffic data. Tshark was utilized to label the unlabeled traffic data with protocol information. Table 3 provides statistical details of the ICSC dataset.  
* MQTT-IoT-IDS-2020 [49]  
Intrusion detection is also one of the tasks with high requirements for classification time. MQTT is one of the most used protocols on the Internet of Things. In this paper, a binary classification task is carried out on this dataset. We labeled each flow according to the author's instructions in the document.  
* ISCX Datasets  
In addition, to verify that our method can also be applied to encrypted traffic classification, we selected two well-known datasets. Although these two datasets were established in 2016, there has still been a lot of research work conducted on them recently, such as the studies of [7; 12; 22; 24; 25; 26; 27].  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Protocol** & **Packet Number (10\({}^{6}\))** & **Session Number** & **Size** \\ \hline BACnet & 5.6 & 76 & 67.1 MB \\ CIP & 2.9 & 137 & 54.4 MB \\ Dmp3 & 4.2 & 5601 & 43.9 MB \\ iec60870 & 2.1 & 11,326 & 219.5 MB \\ Modbus & 2.4 & 15,693 & 138.5 MB \\ MQTT & 8.1 & 1996 & 127 MB \\ S7 comm & 10.5 & 285 & 176 MB \\ \hline \hline \end{tabular}
\end{table}
Table 3: Protocol statistics in ICSC dataset.  
ISCX VPN-nonVPN 2016 (Referred to as VPN Dataset) [50]: This dataset, well recognized in the traffic classification research community, comprises 150 PCAP files totaling 28.0 GB. We based text to classify it into 11 categories: Chat, Email, File Transfer, Streaming, VoIP, VPN Chat, VPN Email, VPN File Transfer, VPN Streaming, VPN VoIP, and VPN Torrent.  
ISCX Tor-nonTor 2016 (Referred to as Tor Dataset) [51]: This dataset includes 85 PCAP files, totaling 22.8 GB. We based text to classify it into 12 categories: Browsing, Chat, Email, File Transfer, Streaming, Tor Browsing, Tor Chat, Tor Email, Tor File Transfer, Tor Streaming, Tor VoIP, and VoIP.