## 3 Methodology
### Model Design  
(1) CNN architecture and its role in encryption application traffic identification  
Through multi-layer convolution and pooling operations, CNN convolutional neural networks gradually reduce the spatial dimensions of encrypted traffic data features while increasing the number of channels and finally carry out Softmax classification through the fully connected layer, which can be effectively used to extract local features of encrypted traffic data. Specifically, CNN first automatically extracts relevant features, such as packet load and statistics in traffic data, through the convolutional layer. Then, the feature dimension is reduced by the pooling layer, the most important feature information is retained, and finally, the classification decision is ultimately determined by the entire fully connected layer. The specific model of CNN is shown in Figure 3:  
Figure 3: CNN model architecture diagram. During the convolution and pooling operations of CNN, we treat \(x_{i}\in R\) as a k-dimensional vector associated with the ith byte in a session or stream. Thus, a session or long flow n can be expressed as an n \(\times\) k matrix, where each line represents a feature vector for each traffic byte in a session or stream. In this way, the entire session or stream is converted into a two-dimensional matrix that can be passed as input to the convolutional layer of the CNN. Specifically, this session or stream can be expressed in the following forms:  
\[x=[x_{1},x_{2},\ldots,x_{n}] \tag{2}\]  
Let xi:i+j represent the traffic bytes from \(x_{i}\) to \(x_{i+j}\), i.e., \(x_{i}\), \(x_{i+1}\), \(\ldots\), \(x_{i+j}\). We define the strainer \(w\in R\) for a window that is used for m bytes during each convolution operation, thereby producing a new feature. Such as the feature \(c_{i}\) can be created by the following equation:  
\[c_{i}=f(w\cdot x_{i:i+m-1}+\alpha) \tag{3}\]  
In the equation mentioned above, \(f\) is an activation function, the \(\alpha\) denotes a bias term. Each filter is used for those possible traffic byte windows \(\{x_{1:m+1},x_{2:m+1},\ldots,x_{n-m+1:n}\}\) during the feature mapping process to generate the feature maps. \[c=[c_{1},c_{2},\ldots,c_{n-m+1}] \tag{4}\]  
In the expression above, \(c\in R\) denotes that the variable \(c\) belongs to the set of real numbers. Subsequently, the feature maps undergo a max temporal pooling operation through the pooling layer, and the next one takes the peak \(c^{*}=\max\{c\}\) as a feature. After multiple convolution and pooling processes, a rich set of features can be extracted. These features are fed into softmax for final output. Despite the fact that data encryption does not alter the overall structure of the data flow, making CNN models still applicable for classifying encrypted traffic, the encryption process may disrupt the request information in protocol-specific parts. This makes the identification of features within different segments of the data more challenging, thereby affecting the performance of the CNN model to some extent. BiLSTM Architecture and Its Role in Encrypted Application Traffic Identification  
To address the limitations of convolutional neural networks (CNNs) in processing encrypted traffic, and for the unique characteristics of this traffic, we need to optimize the model. The time series characteristics of encrypted traffic are represented by packet length series and arrival time series. Inter-arrival time sequences often exhibit linear trends, which can be considered as the superposition of a horizontal smoothing equation and a trend equation, forming a linear recursive sequence. In contrast, packet length sequences display nodular similarities. Since VPN encryption is achieved by connecting to specific websites and nodes, the packet lengths in sessions exhibit particular patterns, combined with the handshake mechanisms characteristic of encrypted traffic, forming a superposition sequence of horizontal smoothing equations and seasonal smoothing equations.