## 5 Asynchronous Sample Encryption Validation and Context Flow Correlation
### Encryption Validation Based on Segmented Entropy Distribution Capsule Neural Network
```
Input: Flow \(F\) or truncated flow \(F_{t}\) or packet sequence \(Pkts\) Output: Encryption semaphore of input flow \(E\), 0 means unencrypted, 1 means encrypted if\(F.T_{proto}==UDPthen// Can be added by prior knowledge if\(F.HVP==\{QUIC,DTLS,...\}\)then\(E=1\) return\(E\) end if if\(F.HVP==UDPthen\)\(Pkt=F[7]//8 thpacket\)\(E=\) SED-CapsNet(\(Pkt\)) return\(E\) end if else // Can be added by prior knowledge if\(F.HVP==\{TLS,MMTLS,SSL,SSH,...\}\)then\(E=1\) return\(E\) end if if\(F.HVP==TCP\)then\(Pkt=F[10]//11 thpacket\)\(E=\) SED-CapsNet(\(Pkt\)) return\(E\) end if return-1//Ignored  end if
```  
**Algorithm 1**Encryption validation procedure of A3C  
The hyper-parameters of SED-CapsNet are demonstrated in Table 1.  
SED-CapsNet takes only one packet of each untested flow (defined by 5-tuples of source/destination IP, source/destination port and transmission protocol) as the input, as the flow has cryptographic integrity. According to the fixed input requirement of the neuron network, we pad the untested packet if its length cannot meet the input size \(K\). The feature used in SED-CapsNet is the segmented entropy distribution. Segmented entropy distribution is a method to obtain the entropy sequence of each segment of the current sequence in fixed-length sliding window \(W\) and fixed-step \(P\). However, since there is only a single sequence, N-truncated entropy [52] replaces entropy to improve accuracy. The N-truncated entropy can be expressed by Formula (1) for a sequence whose element values of a given length \(N_{t}\) conform to the uniform distribution U. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Type** & **Parameters** & **Values** \\ \hline \multirow{6}{*}{Network Parameters} & K & 51 \\  & \(C_{0}\) & 256 \\  & \(S_{0}\) & 8 \\ \cline{1-1}  & \(C_{1}\) & 32 \\ \cline{1-1}  & \(S_{1}\) & 16 \\ \cline{1-1}  & \(C\) & 2 \\ \cline{1-1}  & \(L\) & 3 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Hyper-parameters of SED-CapsNet. \[ \begin{split} H_{N_{t}}(U)=\frac{1}{m^{N_{t}}}\sum_{n_{0}+\ldots+n_{m-1 }=N_{t}}\\ \left[\begin{pmatrix}N_{t}\\ n_{0},\ldots,n_{m-1}\end{pmatrix}\times\left(-\sum_{i=0}^{m-1}\frac{n_{i}}{N _{t}}\log\frac{n_{i}}{N_{t}}\right)\right]\end{split}  \tag{1}\]  
If the N-truncated entropy estimation \(\hat{H}_{N_{t}}(\omega)\) of the untested sequence \(\omega\) is close to 4.87816, the sequence can be considered as a random sequence. In order to detect the encrypted traffic based on segmented entropy distribution, we introduce the capsule neural network model (CapsNet). It uses vector neurons instead of scalar neurons, effectively utilizing the Markov relationship between segmented entropy. Moreover, the CapsNet can effectively reduce the amount of sample data needed for learning. We first use a 2D-convolutional layer to extend the features in the core classification layers because a single N-truncated entropy is only a floating number. Then, the progressive capsule layers detect whether the packet is encrypted. We use both cross-entropy loss and reconstruction loss as the loss function.