## 3 Method
### Features Extraction  
#### 3.2.1 Statistical Feature  
The standard statistical features of network traffic cover multiple dimensions, such as the inter-arrival time of data packets, flow direction (forward or reverse), TCP flag bits (e.g., the PSH flag), etc. [PERSON] et al. proposed over 240 statistical features in their work [32]. However, many of these features are highly correlated and redundant, and the constructed flow data are relatively large, making it difficult to deploy. The method in this paper manually reduces the feature set by screening out redundant features from the 68-dimensional feature set constructed by CICFlowMeter. Then, the Gini coefficient is used to evaluate the classification contribution of each statistical feature. To further broaden the application scope of the feature set, we calculated the Gini gains of the statistical features for the four different datasets mentioned in Section 4.1.2 under different k values (3-10 and all packets) and retained the features whose Gini gains were all greater than 0.2 in the four datasets. Subsequently, we mixed these datasets and independently calculated the Gini gains of the remaining features. Finally, through manual selection, we picked out the 8-dimensional features that exhibited relatively high Gini gains in all datasets and had low computational difficulty and were relatively independent. The selected features and the finally calculated Gini coefficients are shown in Table 1.  
The Gini calculation process is as follows:  
First, for a dataset \(D\) with \(K\) categories, the Gini impurity is defined as \(Gini(D)=1-\sum_{k=1}^{K}p_{k}^{2}\), where \(p_{k}\) is the proportion of category \(k\) in the dataset.  
Next, for a feature \(A\), the dataset is split into subsets according to its value. The Gini gain is defined as \(Gain(A)=Gini(D)-\sum_{i}\left(\
icefrac{{|D|}}{{D}}\right)\times Gini(D_{i})\), where \(D_{i}\) is the subset divided based on feature \(A\).  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature Name** & **Description** & **Gini Gain** \\ \hline _pkt\_len\_mean_ & Mean packet length. & 0.5755 \\ _totlen\_fwd\_pkts_ & Total length of forward packets. & 0.4429 \\ _active\_max_ & Maximum active state. & 0.6707 \\ _bwd\_pkt\_len\_min_ & Minimum length of backward packets. & 0.3237 \\ _bwd\_blk\_rate\_avg_ & Average backward block rate. & 0.3297 \\ _bwd\_iat\_min_ & Minimum backward inter-arrival time. & 0.3331 \\ _flow\_bpts\_s & Flow bytes per second. & 0.6731 \\ _init\_fwd\_win\_bpts_ & Initial forward window bytes. & 0.3954 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Description of feature names.  
All the selected features can be calculated incrementally without storing past data packets. Although the examples provided in this paper do not select them, for features that require the calculation of standard deviation, such as _pkt_len_std_, the Welford algorithm [33] can be used for incremental calculation without additional space consumption for storing data packets.  
Mean Calculation  
Suppose we have a sequence of data points \(x_{1},x_{2},\cdots,x_{n}\). The traditional way to calculate the mean \(\mu_{n}\) is as follows:  
\[\mu_{n}=\frac{1}{n}{\sum\limits_{i=1}^{n}{x_{i}}}\]  
Given that the mean of the first \(n-1\) data points is \(\mu_{n-1}\), when the \(n\)-h data point \(x_{n}\) is added, the new mean \(\mu_{n}\) can be calculated by the formula:  
\[\mu_{n}=\mu_{n-1}+\frac{x_{n}-\mu_{n-1}}{n}\]  
For the calculation of the variance \(\sigma_{n}^{2}\), an incremental idea is also adopted. Given that the variance of the first \(n-1\) data points is \(\sigma_{n-1}^{2}\) and the mean is \(\mu_{n-1}\), when the \(n\)-th data point \(x_{n}\) is added, the formula for the variance is as follows:  
\[\sigma_{n}^{2}=\frac{n-1}{n}\sigma_{n-1}^{2}+\frac{(x_{n}-\mu_{n-1})(x_{n}-\mu _{n})}{n}\]