## 3 Methodology
### Data Preprocessing Module  
As the first step for traffic classification, data preprocessing is also a critical step to ensure the effectiveness of model training. We have processed the original traffic data of PCAP in accordance with the steps in Figure 2:  
1. **Session Segmentation:** The purpose of segmentation is to reduce continuous PCAP streams based on sessions. The two common types of traffic representation are sessions and flows. A session is a stream divided into five tuples (source IP address, source port, destination IP address, destination port, and protocol). Flows are very similar to sessions but only contain traffic in a single direction, meaning that the source IP/port and destination IP/port cannot be swapped. In this study, continuous PCAP files are segmented based on sessions, converting incoming traffic files into PCAP format data. Each session is limited to a maximum of 100,000 packets and 100,000 bytes to facilitate subsequent uniform processing.  
Figure 1: Overview of CLSTM-MT: The architecture of CLSTM-MT has been divided into three components: the data preprocessing module, the model training module, and the model validation module. Raw PCAP traffic is processed by the data preprocessing module into four npy feature files. Then, these files were divided in an 8:1:1 ratio and segmented into training, validation, and testing datasets. The training dataset is further segmented, a small part (1–20%) of labeled data are used as input data for model training, and a large portion of the unlabeled data (the remaining 80% to 99%) are used as input for model validation. This approach helps train our model effectively.  
Figure 2: Data preprocessing module: The module consists of five parts, which are session segmentation, feature extraction, data normalization, feature coding, and dataset segmentation.  
2. **Feature Extraction:** Before extracting features, we anonymize the packets and select the most useful features for traffic identification. 1. **Packet Anonymization:** To ensure the normal use of traffic data, we anonymize the IP and MAC addresses of every packet in each session to prevent user's privacy from being divulged and to protect the usability of the traffic data. 2. **Feature Selection:** We extract the following features: Sequence Length Feature (Sequence), the length of the sequence; Payload Feature (Payload), the first Byte_Num bytes of the payload from the first Packet_Num packets; and Statistical Feature (Statistic), 26-dimensional statistical features of the traffic (e.g., flag features, packet size features, protocol distribution features, etc.).  
We set Packet_Num to 4 and Byte_Num to 256 because the initial few packets of network traffic typically contain a large number of key information, for example, TCP/UDP ports, protocol type, sequence numbers, and flags, which are very useful for traffic type identification. Extracting partial data from the first few packets rather than the entire data stream can significantly reduce computational load while still retaining sufficient information for classification. 3. **Data Normalization:** To enable the model to better learn the underlying relationships in the data, we normalize packet payload data, sequence data, and statistical data to the [0, 1] range using the normalization formula shown in the formula below. \[\text{X}=\frac{X_{i}-X_{\text{min}}}{X_{\text{max}}-X_{\text{min}}}\] (1) 4. **Feature Encoding:** The processed features are converted into numerical form and saved as npy files to facilitate model processing. 5. **Dataset Splitting:** Finally, the preprocessed data are divided into training and validation sets according to the required proportions.