## 2 Related Work
### Encrypted Traffic Classification and Feature Engineering  
#### 2.2.1 Encrypted Traffic Detection  
Encrypted traffic detection is a special field in encrypted traffic classification, and its purpose is to screen encrypted traffic from network traffic and provide a guarantee for the input of encrypted traffic classification. Although plaintext traffic can be regarded as encrypted traffic in actual classification, in the training process, the significance of the features of plaintext traffic may seriously interfere with the category common feature learning of the encrypted traffic classifier, resulting in the appearance of overfitting.  
At present, the randomness measure is used to verify the encryption of traffic. [PERSON] et al. [30] proposed a method for encrypted traffic detection by splitting packets into byte units and taking advantage of the difference in coverage interval and distribution between encrypted and unencrypted traffic byte units in the ASCII encoding field. [PERSON] et al. [31] proposed EIWCT, a time-delay adaptive encryption traffic blind recognition algorithm based on the weighted cumulative sums test, to solve the problem that entropy measure is difficult to fine control the collection time and it ignores the random variation trend of data. However, as a core network carrying various other forms of data transmission, the Internet has some compressed traffic to ensure network QoS and energy consumption of some devices. In data processing, data compression and encryption both increase the information entropy of the source data [30]. If random measures detect the encrypted traffic without considering the existence of compressed traffic, the result may be interfered with by compressed traffic, and the false positive rate would be high. In recent years, the academic community has gradually considered the interference of compressed flow. Therefore, [PERSON] et al. [32] proposed a method HEDGE based on multiple random measures to separate flow-transformed encrypted files, flow-transformed compression files, and flow-transformed plaintext files. The goal of HEDGE is to distinguish the encrypted, compressed, and plaintext traffic. However, its experiment is implemented by transmitting the encrypted file, the compressed file, and the plaintext file, respectively, in the TCP environment. There is some difference between an encrypted file and the actual encrypted traffic, and the difference mainly lies in the mechanism of the security protocol. Several random measures specified in NIST SP 800-22 are tested in this method. Finally, three random measures, frequency within block test, cumulative sums test, and approximate entropy test, are selected as the separation indexes. The encrypted traffic detection is realized effectively.  
With the development of machine learning technologies, a hybrid method combining machine learning and random measures has been developed. [PERSON] et al. [33] put forward the Heuristic Statistical Testing (HST). Traffic randomness was measured based on four random measures, and C4.5 was used for encrypted traffic detection.  
[PERSON] et al. [34] proposed an entropy-based feature extraction algorithm to solve the problem that encrypted traffic and unencrypted compressed traffic need to be distinguished before subsequent encrypted traffic classification. They converted the traffic into entropy vector features through a fixed-length sliding window to imply the classification of encrypted traffic and compressed traffic.  
According to the comparison of experimental results of the above papers, the most representative research in encrypted traffic detection is HEDGE.