## 3 Model Description  
### Overview of TCReC  
TCReC can reconstruct the characteristic information of network flow according to incomplete data. This section takes the training process of the TCReC model as an example to introduce the process of the method. The process can be divided into four parts, and contains seven key steps, as illustrated in Figure 3.  
\begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Method** & **Loss Handling** & **Model Architecture** & **Recon. Ability** & **Evaluation Metrics** \\ \hline Mean Imputation & Mean Filling & Statistical & No & F1-score, Accuracy \\ KNN & Nearest Neighbor & Unsupervised Learning & No & F1-score, RAI \\ RNN-based & Sequence Modeling & RNN & No & F1-score, RAI \\ Transformer & Self-Attention & Transformer & Limited & F1-score, RAI \\
**TCReC (Ours)** & Masked Autoencoder & Transformer-based AE & **Strong** & RAI, F1-score, t-SNE \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of Related Work and Key Features.  
The steps of the process are as follows:  
1. The original network traffic data is preprocessed to form the input data suitable for the model.
2. The input data are segmented into fixed-size data blocks. The packets are then masked according to the mask ratio, and form two groups of packets: masked and unmasked.
3. The two groups of data are embedded, and positional embeddings are added based on the whole input data.
4. Unmasked blocks are sent to the encoder. These high-dimensional data will be mapped into low-dimensional space by the encoder.
5. The output is spliced with the masked blocks according to the position information.
6. The spliced data blocks are input into the decoder, and the missing characteristics are reconstructed according to the characteristics extracted by the encoder.
7. The decoder outputs the reconstructed network traffic data. The main component of the process, comprising steps (3) to (6), is referred to as TCReC. The key functions of TCReC are as follows:  
1. Obtaining the characteristics of network traffic is the premise of characteristic reconstruction. TCReC has good characteristic extraction ability and can fully learn the characteristic information of the data.
2. This study focuses on the reconstruction of network traffic, while the decoder of TCReC can play the role of data reconstruction.
3. Our research object is the packet loss traffic data, while the mask operation tries to simulate a packet-loss scenario and enables TCReC to learn and reform the characteristics of missing data, then complete the reconstruction task through incomplete data.  
It is worth noting that TCReC functions as an intermediary between the data collection process and model inference, rather than an inline network component. It operates after packet collection and before downstream analysis tasks such as traffic classification or intrusion detection. As a result, it does not introduce latency into the actual data transmission process. Its computational cost affects only the processing time of the analytical pipeline,  
Figure 3: The training process of TCReC.  
making it well-suited for deployment in edge computing environments where reliable traffic analysis is needed without compromising network responsiveness.