# TransECA-Net: A Transformer-Based Model for Encrypted Traffic Classification
## 4 Experimental Result
### Basic Experiment
The right graph illustrates the training accuracy and test accuracy for each epoch, where the _x_-axis represents the number of epochs and the _y_-axis indicatesthe accuracy. From the graph, it is evident that the curve becomes smooth after the 15 th epoch, with the accuracy approaching 99%. Additionally, after extensive experimentation, it was found that the model generally achieves optimal performance after 40 training iterations. Although the complexity of the model increases after incorporating ECANet and Transformer, the powerful parallel-processing capability of the Transformer and the optimized feature-extraction ability of ECANet enable the TransECA-Net model to converge faster in encrypted network traffic classification tasks, reducing computational resource consumption with fewer training iterations. The calculated overall average accuracy rate of this model is 98.25%. Table 4 displays the accuracy and recall rates for 12 different types of network traffic. The data demonstrate that the TransECA-Net model achieved an average accuracy of 97.65% for 12-class traffic classification in the ISCX dataset, with an average precision of 98.15% and an average recall rate of 97.91%. Figure 4 displays the normalized confusion matrix of TransECA-Net on the 12-class encrypted traffic from the ISCX dataset. The vertical axis represents the true classes, while the horizontal axis indicates the predicted classes. The diagonal elements show the correct classification rates for each category, whereas the off-diagonal elements reflect misclassification patterns. Analysis of Table 4 and Figure 4 reveals a bidirectional confusion between the Chat and VPN-Chat classes: 0.80% of the Chat samples were misclassified as VPN-Chat, while 0.50% of the VPN-Chat samples were, conversely, misclassified as Chat. This phenomenon may stem from similarities in message interaction frequency and payload distribution between non-encrypted communications and encrypted channels. The File class exhibits notable misclassification characteristics, with 6.50% of samples misclassified as P2P and 3.35% as Streaming, indicating feature-space overlap between the bursty traffic patterns of large file transfers, P2P chunked transmission, and streaming \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Category** & **Accuracy** & **Precision** & **Recall** & **Category** & **Accuracy** & **Precision** & **Recall** \\ \hline Chat & 98.17\% & 98.67\% & 99.17\% & VPN-Chat & 99.83\% & 99.50\% & 99.83\% \\ Email & 99.00\% & 99.17\% & 99.00\% & VPN-Email & 98.33\% & 100\% & 98.33\% \\ File & 93.56\% & 89.56\% & 94.33\% & VPN-File & 98.49\% & 98.98\% & 99.49\% \\ P2P & 99.46\% & 100\% & 99.46\% & VPN-P2P & 96.74\% & 98.89\% & 96.74\% \\ Streaming & 99.75\% & 99.50\% & 99.75\% & VPN-Streaming & 99.19\% & 99.19\% & 100\% \\ VoIP & 92.20\% & 94.37\% & 89.33\% & VPN-VoIP & 99.50\% & 100\% & 99.50\% \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The classification results on 12 types of traffic. Figure 3: TransECA-Net model performance. buffering mechanisms. The VoIP class demonstrates dual confusion patterns: 3.10% of samples were misclassified as P2P, potentially due to similar heartbeat mechanisms, while 7.60% were misclassified as VPN-VoIP, suggesting insufficient discriminative power in packet timing features for encrypted voice streams. Regarding performance metrics, the File class achieved the lowest classification accuracy of 93.56%, with a precision of 89.56% and recall of 94.33%. The significant disparity between precision and recall indicates a higher false-positive rate, consistent with its role as a primary source of misclassification in the confusion matrix. The VoIP class attained 92.20% accuracy, with precision and recall rates of 94.37% and 89.33%, respectively, revealing a trade-off between false positives and false negatives. This likely relates to the bidirectional encryption characteristics of voice traffic and its similarity to VPN-VoIP protocols.