## 4 Experiment
### Verification of Incremental Classification Strategy  
In this experiment, for the four datasets of ICSC, VPN, TOR, and MQTT, by varying the value of K (the number of data packets) and applying the incremental calculation method, we evaluated the performance indicators of the classification strategy, including ACC, PR, RC, F1, as well as the classification time, to verify the relevant theoretical conclusions. The experimental results are shown in Figure 3. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Dataset** & **Method** & **PR** & **RC** & **ACC** & **F1** & **Classification Time (s)** \\ \hline \multirow{4}{*}{**VPN-nonVPN**} & FSNet & 75.02\% & 72.38\% & 72.38\% & 73.68\% & 241.93 \\  & FineWP & 59.38\% & 78.46\% & 78.46\% & 67.60\% & 241.93 \\  & ETC-PS & 66.65\% & 84.69\% & 84.69\% & 74.59\% & 273.83 \\  & SwiftSession (XGBoost) & **88.55\%** & **88.36\%** & **88.36\%** & **88.45\%** & **91.87** \\ \hline \multirow{4}{*}{**Tor-nonTor**} & FSNet & 74.57\% & 72.46\% & 72.46\% & 73.50\% & 162.88 \\  & FineWP & 76.58\% & 68.75\% & 68.75\% & 72.45\% & 162.88 \\  & ETC-PS & 88.56\% & 94.54\% & 94.54\% & 91.45\% & 179.89 \\  & SwiftSession (XGBoost) & **98.57\%** & **98.57\%** & **98.57\%** & **98.57\%** & **10.45** \\ \hline \multirow{4}{*}{**ICSC-Dataset**} & FSNet & 84.52\% & 86.21\% & 86.21\% & 85.36\% & 201.05 \\  & FineWP & 87.34\% & 86.45\% & 86.45\% & 86.89\% & 201.05 \\  & ETC-PS & **99.67\%** & **99.35\%** & **99.35\%** & **99.51\%** & 221.25 \\  & SwiftSession (XGBoost) & 98.84\% & 98.84\% & 98.84\% & 98.85\% & **2.59** \\ \hline \multirow{4}{*}{**MQTT-IDS-2020**} & ITCT Transformer & 87.00\% & 82.00\% & 82.00\% & 81.00\% & **2.14** \\  & SwiftSession (XGBoost) & **98.53\%** & **98.52\%** & **98.52\%** & **98.48\%** & 2.67 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparison experiment results. In each dataset, as the value of K increases from 3 to 10, the classification accuracy indicators generally show an upward trend or remain stable at a high level, indicating that an increase in the number of data packets helps to ensure or improve the classification accuracy. When all data packets are used, the accuracy indicators show a slight decline in some datasets, possibly due to the introduction of complex factors resulting from the excessive data volume but remain at a relatively high level overall. In datasets such as ICSC and MQTT, the incremental method demonstrates slightly reduced performance for high-K-value scenarios compared to fixed-K classifiers. This phenomenon primarily stems from its inherent tendency to make classification decisions at lower K values, as evidenced by Table 4 showing an average consumption of 4-5 data packets per classification--indicating that most determinations occur by the third packet. When the third-packet classifier produces suboptimal results despite showing high confidence probabilities, the incremental approach underperforms relative to classifiers employing larger K values (e.g., 7, 8, 9), though the performance disparity remains marginal at less than 1%. Crucially, this minor limitation does not diminish the incremental method's significant advantages over fixed-K-value approaches, as it successfully maintains an optimal balance between rapid classification speed (achieving decisions in 3-5 packets) and sustained high accuracy across various operational scenarios. In addition, on the four datasets, the accuracy indicators obtained by the incremental method are comparable to those at a high K value and are even better in some datasets. The classification time, compared with that at a high K value, is significantly shortened, with the maximum time being no more than 90% of the classification time at a high K value, greatly improving the classification efficiency. The experiments conducted on these four datasets have comprehensively validated the theory concerning the influence of the incremental method on classification performance and time.