## 3 Method
### Features Extraction
#### 3.2.2 Sequence Feature  
Considering the property that path signatures can be incrementally calculated, the method in this paper introduces path signatures to extract the sequential features of network flows. In practical applications, multiple sequential feature calculation methods, such as Markov chains, can also be applied according to requirements. The sequence feature extraction in this paper process is as follows: After capturing packet \(i\), we added the length \(L_{i}\) of this packet to the previous length sequence \(S_{i-1}=(L_{1},L_{2},\ldots,L_{i-1})\), generating the updated sequence \(S_{i}=(L_{1},L_{2},\ldots,L_{i})\). In this sequence, \(L_{i}<0\) indicates that the packet was sent from the client to the server; instead, \(L_{i}>0\) indicates that the packet was sent from the server to the client. Inspired by the work of [PERSON] et al. [7], we extend the original sequence \(S\) to seven dimensions, specifically as follows:  
* **Packet length sequence**_SL_: Consists of the absolute values of each packet length in sequence \(S\). * **Cumulative byte sequence**_CS_: The prefix sum of the packet length sequence \(SL\), that is, \(CS_{i}=\sum_{1}^{i}{SL_{i}}\). * **Length sequence**_U_ from the client to the server: Contains all the positive subsequences in sequence \(S\). * **Cumulative length sequence**_CU_ from the client to the server: It is the prefix sum of the length sequence \(U\), that is, \(CU_{i}=\sum_{1}^{i}{U_{i}}\). * **Length sequence**_P_ from the server to the client: Contains all the negative subsequences in sequence \(S\). * **Cumulative length sequence**_CP_ from the server to the client: It is the prefix sum of the length sequence \(P\), that is, \(CP_{i}=\sum_{1}^{i}{P_{i}}\). Furthermore, to enhance the distinguishability of the calculated traffic path features, we introduced the time interval sequence **IT** between packets and the FLAGS field of the TCP protocol within the packet header field to calculate the sequence features. Eventually, after eliminating the redundant **SL**, we utilized a seven-dimensional sequence to calculate the traffic path features: **IT**, **FLAGS**, **CS**, **U**, **CU**, **P**, and **CP**. Table 2 presents an example of the extended sequence of the first ten packets of a VPN chat flow. This dimensional feature path was used to calculate the path signature. The following is a brief introduction to the path signature method and its incremental calculation method. For the specific details of the path signature, please refer to the paper of [34]:  
Path signatures are a feature extraction method that encodes linear and nonlinear interactions [35]. The feature vectors generated by this method have a fixed length independent of the number of data input points or sampling interval. As a mathematical tool, path signatures have significant applications in various fields, including stochastic analysis, machine learning, and differential geometry [2; 36; 37; 38]. For a continuous path \(X:[0,\ T]\to R^{d}\), the path signature is an infinitely long sequence of the path, with each order's signature terms composed of the following:  
Let \(X=X^{1},X^{2},\cdots,X^{d}\) be a d-dimensional path, and \(X_{t}=X_{t}^{1},\cdots,X_{t}^{d}\) represents the value of the path \(X\) at time \(t\in[0,T]\). The \(n\)-th level part \(S(X)_{0,t}^{n}\), (\(n=0,1,2,\cdots\)) is defined as follows:  
\[\left\{\begin{matrix}S(X)_{0,t}^{0}=1,n=0\\ S(X)_{0,t}^{1}=\int_{0}^{t}dX_{s}^{1},\int_{0}^{t}dX_{s}^{2},\cdots,\int_{0}^{ t}dX_{s}^{d},n=1\\ S(X)_{0,t}^{n}=\int_{0<s_{1}<\cdots<s_{n}<t}{\it{\it{\Delta}}}{\it{\DeltaHere, \"\(\oplus\)\" is used to denote the concatenation of the preceding vector and the succeeding vector. As described in the previous two subsections, since both the sequence features and statistical features used to form the fusion features can be incrementally calculated, the fusion features also support incremental calculation.