# MT-FBERT: Malicious Traffic Detection Based on Efficient Federated Learning of BERT
## 4 Experiments
### Few-Shot Analysis  
To validate the robustness of MT-FBERT in few-shot scenarios, we set the labeled data size to 10%, 40%, and 80% and compare MT-FBERT with baselines on four datasets. Experimental results are shown in Tables 5-8. In addition, to clearly demonstrate the performance, \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Comparison Methods** & \(\mathbf{t}_{observed\_value}\) & \(\mathbf{t}_{critical\_value}\) & **Significant Improvements** \\ \hline MT-FBERT vs. FlowPrint & 3.9738 & 0.0004 & True \\ \hline MT-FBERT vs. TFE-GNN & 2.1821 & 0.0370 & True \\ \hline MT-FBERT vs. YaTC & 1.2622 & 0.2166 & False \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Significance between MT-FBERT and baselines. Figure 5: Comparative results in terms of Avg. AC, Avg. PR, Avg. RC and Avg. F1 across four datasets. we computed the average AC, PR, RC, and F1 across four datasets under limited labeled data conditions, denoted as Avg. AC, Avg. PR, Avg. RC and Avg. F1. The results are shown in Figure 6. From the figure, it can be observed that the Avg. AC, Avg. PR, Avg. RC and Avg. F1 of MT-FBERT at the different labeled sample sizes is significantly higher than other methods. The Avg. F1 of MT-FBERT decreases only slightly from 0.9175 (at 80% labeled data) to 0.9042 (at 10% labeled data), a drop of less than 1.5 percentage points. This demonstrates the MT-FBERT's remarkable stability and consistency, indicating its low dependence on large volumes of labeled data. Notably, the MT-FBERT is able to achieve performance close to that of higher labeling ratios, even when using only 10% of labeled samples. This suggests that the MT-FBERT can effectively leverage limited supervision for learning and optimization. This characteristic is particularly valuable in real-world scenarios where labeled malicious traffic data is difficult to obtain, as it reduces annotation costs and improves the practical usability of the model. \begin{table}
\begin{tabular}{c c c c c c c c c c c c c} \hline \hline
**Labeled Data** & \multicolumn{4}{c}{**10\%**} & \multicolumn{4}{c}{**40\%**} & \multicolumn{4}{c}{**80\%**} \\
**Size** & \multicolumn{4}{c}{**10\%**} & \multicolumn{4}{c}{**40\%**} & \multicolumn{4}{c}{**80\%**} \\ \hline
**Method** & **AC** & **PR** & **RC** & **F1** & **AC** & **PR** & **RC** & **F1** & **AC** & **PR** & **RC** & **F1** \\ \hline MT-FBERT & **0.8629 \({}^{*}\)** & **0.8518** & **0.8389** & **0.8322** & **0.8650** & **0.8580** & **0.8516** & **0.8673** & **0.8685** & **0.8691** & **0.8693** & **0.8690** \\ FlowPrint & 0.4633 & 0.3886 & 0.3665 & 0.3754 & 0.4991 & 0.4344 & 0.4315 & 0.4327 & 0.4870 & 0.4210 & 0.4133 & 0.4164 \\ TFE-GNN & 0.4024 & 0.1619 & 0.4024 & 0.2309 & 0.3996 & 0.2869 & 0.3996 & 0.3088 & 0.2640 & 0.3550 & 0.2640 & 0.2055 \\ YaTC & 0.5703 & 0.3253 & 0.5703 & 0.4143 & 0.6426 & 0.6238 & 0.6426 & 0.5933 & 0.7300 & 0.7315 & 0.7300 & 0.7038 \\ \hline \hline \end{tabular} \({}^{*}\) A number in bold means that the corresponding method performs better than its counterpart does, for the same metric and the same labeled sample size.  
\end{table} 
Table 6: Comparison results on CICMalAnal2017 dataset using different labeled sample sizes.