## 6 Evaluation
### Analysis and Discussion
#### 6.5.2 Why Collect the Sample on an Android Device, Not on the Server? First, it should be made clear that it is feasible to capture traffic in the VPN server of A3C-Android. However, in the actual environment, an A3C-Android VPN server can be used by multiple A3C-Android devices, so it has high consumption to maintain connection and traffic forwarding, and collecting samples on the server may bring performance problems. In addition, the labels are carried out on android devices, and if the samples and labels are not acquired on the same device, there will be problems with timestamp alignment and label information transmission. Last but not least, the current Android devices have adequate hardware performance, which can support local sample collection and preservation, and the mobility of the client makes sample collection on the android devices more rational and comprehensive. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Method** & **Pr** & **Rc** & **F1** & **Time (s)** \\ \hline HEDGE & 90.83\% & 64.14\% & 75.19\% & 2439.28 \\ SED-CapsNet & 87.96\% & 67.33\% & 83.12\% & 368.86 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: A3C vs. HEDGE in encryption detection. 6.5.3. Why the Recall of Encryption Detection Is Low? The recall rate is low because part of the encrypted samples tested as unencrypted. The main reason is that the samples adopted in the experiment are TLS and HTTP samples. In TLS samples, there is a plaintext TLS header, so the overall randomness will be lower if the packet length continues to fall. However, our encrypted traffic detection aims to ensure that the samples in the labeled dataset are all encrypted traffic samples (prevent the classifier from using implicit plaintext features, which would cause colossal over-fitting). A high precision rate can guarantee that almost all samples are encrypted, and the wasted only slightly decreases the collection efficiency. 6.5.4. Why HEDGE Is So Slow in Encryption Detection? HEDGE mainly uses three randomness test methods: block bit frequency test, accumulative sum test, and approximate entropy test, all of which take bits as the test calculation unit. The approximate entropy test has a high time complexity, resulting in a long detection time. On the contrary, N-truncate entropy used in SED-CapsNet takes byte as the calculating unit, and more simple and practical features guarantee the accuracy and significantly reduce the time cost. However, because the capsule neural network is very complex, its detection also consumes time, and the cost is where future research needs to focus. 6.5.5. Less than 1% Interfering Packets Really Matter? The interference here is usually due to background traffic from the OS. However, it is worth noting that it interferes with every type of sample since manual collection can only collect traffic for one application at a time on a device. Therefore, background traffic will interfere with each type of labeled sample, resulting in the accumulation of concept drift, thus reducing accuracy. In the case of enormous samples (such as backbone network boundary), even a slight decrease in accuracy will lead to a significant increase in the number of misclassified samples. 6.5.6. A3C-Android Introduces a VPN Server Outside of the End System, Is It Achieved the \"Execute on the End System\" and \"Collection and Labeling Procedure Shall Not Affect the Features of Traffic\"? Due to the characteristics of the Android system, a VPN server is necessary, but this server is transparent to the user who operates A3C-Android. The user does not need to configure the server unless the user wants to build the overall environment in a specific environment independently. So it achieves the \"Execute on the end system\" requirement. In addition, a VPN server functions as a router or switch to utilize the VPN Service interface of Android. Therefore, the VPN server is only responsible for forwarding, which has no impact on the time. There are many routers or switches in a regular network environment. So it does not affect the features.