## 3 Analysis of Encrypted Traffic Features
### Analysis of Traffic Base Features and Combined Features  
This study closely follows and draws upon the latest research achievements in the field of encrypted traffic identification. These studies focus on the bidirectional communication characteristics when extracting features. They systematically extract diverse feature sets from multiple dimensions--temporal, spatial, and spatiotemporal interactions--addressing uplink, downlink, and bidirectional communication processes, respectively. The base feature set encompasses fundamental session attributes such as origin_port, destination_port, destination_pkts, origin_bytes and destination_bytes. These features directly reflect the core communication profile of encrypted traffic. Additionally, advanced combined features are computed from these base features. This study incorporates 80-dimensional advanced features extracted by the CICFlowmeter tool [22], including features such as bwd_pkts_per_sec, flow_pkts_per_sec, and down_up_ratio. To extract the advanced features, we first utilize Zeek to monitor and log network packets. These logs are then fed into the CICFlowmeter module, which processes them to extract a comprehensive set of advanced features. These features include basic connection characteristics like duration, packet and byte counts, as well as more nuanced attributes such as traffic statistics, protocol-specific behaviors, and host interaction patterns. These combined features are capable of capturing more detailed and crucial information about communication behaviors within encrypted traffic. The CICFlowmeter's feature set, known for its comprehensiveness and depth, provides substantial support for detailed analysis. To objectively evaluate the significance of each feature in differentiating between malicious and benign encrypted traffic, this study employs ANOVA (analysis of variance) as a quantitative tool. ANOVA assesses feature importance by calculating the F statistic for each feature, expressed as  
\[\textit{F-value}=\frac{\text{inter-group variance}}{\text{within-groups variance}/(\text{category\_count}-1)} \tag{1}\]  
inter-group variance measures the mean value differences of features across categories, while within-group variance measures variability within each category. A higher F-value indicates greater importance in distinguishing between categories. By comparing F-values, this study identifies which features are most critical for distinguishing malicious from benign encrypted traffic, thereby guiding subsequent feature selection. This study conducted an analysis on both session-level and IP-level sample features, selecting the top 20 features based on their importance scores for visualization, as shown in Figure 1. Features marked in red represent base features of traffic, while those marked in blue indicate combined features derived from the integration of several fundamental features. Specifically, in session-level features, five features--down_up_ratio, fwd_pkts_per_sec, flow_pkts_per_sec, bwd_pkts_per_sec, and bwd_bulk_rate--demonstrated importance scores ranging from 3133 to 6881, significantly outperforming other features whose importance scores generally fell below 673. This suggests that these features are highly indicative of malicious behavior in encrypted communication. Similarly, at the IP level, down_up_ratio.mean, bwd_bulk_rate.mean, and idle.tot.max showed exceptionally high importance scores (ranging from 379 to 495), while the rest of the features had scores below 250. It is worth noting that all of these highly important features are the result of cross-combinations of base features, rather than single base features themselves. This finding highlights the fact that while base features are intuitive and easily obtained, they offer relatively limited information and are insufficient to fully capture the complexity of encrypted communication on their own.