# TransECA-Net: A Transformer-Based Model for Encrypted Traffic Classification
## 4 Experimental Result
### Dataset  
This study utilizes the ISCX VPN-nonVPN dataset, which was created in 2016 by the Canadian Institute for Cybersecurity (CIC) at the University of New Brunswick. The key characteristics of this dataset are as follows:  
1. Traffic types: The dataset includes various types of VPN-encrypted traffic as well as unencrypted regular internet traffic. It covers common network services and applications such as web browsing, email, file transfer, and VoIP (Table 2).
2. Realistic scenario simulation: All traffic data were generated in a controlled environment to simulate real-world network communication scenarios.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Comparison Aspect** & **Transformer** & **LSTM** \\ \hline Processing capacity & Strong & Weak \\ Dependency capture & Strong & Weak \\ Computational efficiency & High & Mid \\ Feature learning & Automatically learn the features from the data & Dependence on manual \\ Model complexity & Complex & Simple \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of Transformer and LSTM performance.  
Detailed annotations: The dataset is thoroughly labeled, indicating whether the traffic was transmitted via a VPN and specifying which VPN protocol was used.  
Based on the ISCX VPN-nonVPN dataset, the preprocessing method used by [PERSON] in 2017 [20] was implemented with the USTC-TL2016 tool. The processing involves four steps:  
1. Traffic segmentation: Split raw PCAP traffic into session and flow units. To ensure uniform input dimensions for CNN, truncate each session/flow to retain only 784 bytes.
2. Traffic cleaning: Remove retransmitted packets, corrupted packets, and non-encrypted traffic.
3. Image generation: Convert traffic bytes into a one-dimensional numerical sequence, where each byte corresponds to an integer value between 0 and 255, forming time-series data similar to textual sequences.
4. IDX format conversion: Convert byte sequences into IDX3 files (input data) and IDX1 files (labels) to align with frameworks like PyTorch 3.9/TensorFlow ([[https://tensorflow.google.cn/?hl=zh-cn](https://tensorflow.google.cn/?hl=zh-cn)]([https://tensorflow.google.cn/?hl=zh-cn](https://tensorflow.google.cn/?hl=zh-cn)), accessed on 20 September 2023). Label PCAP files according to ISCX dataset descriptions and remove ambiguous categories (e.g., conflicting portions between \"Browser\" and \"Streaming\"), ultimately retaining 12 distinct classes.  
The selection of this dataset is based on the following rationale. As an internationally recognized benchmark dataset widely adopted in the field of cybersecurity (references [15; 22; 23]), its evaluation results possess comparative value across studies. The 12 service scenarios constructed by the dataset comprehensively cover both VPN-encrypted traffic (six categories) and non-VPN regular traffic (six categories), accurately characterizing multi-dimensional network behavior features, including browsing, email, and P2P transmission (as shown in Table 2). The controlled environment generation mechanism, combined with manual cleaning processes, achieves the high-precision labeling of traffic types and encryption states by eliminating retransmitted or corrupted packets. In the preprocessing stage, the truncation of 784 bytes per flow allows the conversion of raw data into a standardized 28 \(\times\) 28 image format, fully aligning with the input dimensional requirements of deep learning models such as CNNs. It is particularly noteworthy that the unique protocol encapsulation mechanism of VPN tunnels significantly increases the complexity of traffic pattern decoupling, which effectively validates the model's ability to parse encryption-obfuscated features.