## 3 Methodology
### Model Design
To leverage the preceding numerical features for predicting future data changes, we consider incorporating Bidirectional Long Short-Term Memory networks (BiLSTMs) to enhance the model. As an advanced form of recurrent neural networks (RNNs), BiLSTMs include memory cells within their network architecture that effectively capture and retain long-term dependencies. This makes BiLSTMs particularly suitable for handling time-series characteristics of encrypted traffic data, automatically learning temporal dependency features within the traffic data. Specifically, BiLSTMs first read the traffic data sequence and process these data over each time step. At each of these time steps, BiLSTMs not only consider the current data but also integrate information from both preceding and subsequent contexts, thereby providing a more comprehensive understanding of the entire sequence. After multiple layers of processing, the final layer outputs a fixed-length vector that encapsulates the key features of the entire traffic sequence. These feature vectors are sent to a fully connected layer, resulting in a final classification decision. By doing so, BiLSTMs can better capture the complex patterns and temporal dependencies in encrypted traffic, offering more accurate and robust traffic identification capabilities compared to traditional CNN methods. Additionally, the bidirectional nature of BiLSTMs allows them to simultaneously consider past and future contextual information during analysis, further enhancing the model's expressiveness and predictive accuracy. The LSTM model architecture is shown in Figure 4:  
During the training part, for a specific time step \(t\), the minimum input batch is expressed as \(\text{X}_{\text{t}}\in\text{R}^{\text{n}\times\text{d}}\), where \(n\) indicates the count of sequence samples, and \(d\) denotes the feature dimension at each step. In the BiLSTM architecture, let the forward and backward hidden states be expressed as \(\overset{\rightarrow}{\text{H}_{\text{t}}}\in\text{R}^{\text{n}\times\text{h}}\) and \(\overset{\leftarrow}{\text{H}_{\text{t}}}\in\text{R}^{\text{n}\times\text{h}}\), respectively, where \(h\) symbolizes the number of hidden units. The status update formula of the forward LSTM is shown below:  
\[\overset{\rightarrow}{H_{t}}=\varphi\bigg{(}X_{t}W_{xh}+\overset{ \rightarrow}{H_{t-1}}W_{hh}+b_{h}\bigg{)} \tag{5}\]  
The status update formula of the backward LSTM is shown below:  
\[\overset{\leftarrow}{H_{t}}=\varphi\bigg{(}X_{t}W^{\prime}_{xh}+\overset{ \leftarrow}{H_{t+1}}W^{\prime}_{hh}+b^{\prime}_{h}\bigg{)} \tag{6}\]  
Here, \(\varphi\) represents the activation function. \(W_{xh}\) represents the weight matrices from the input to the hidden layer and \(W_{hh}\) represents the weight matrices from the hidden layer to itself. Respectively, \(W^{\prime}_{xh}\) and \(W^{\prime}_{hh}\) represent the weight matrices for the reverse direction. \(b_{h}\) and \(b^{\prime}_{h}\) are the bias terms. The hidden state \(\text{H}_{\text{t}}\in\text{R}^{\text{n}\times\text{2h}}\) is a combination of the forward hidden \(\overset{\rightarrow}{\text{H}_{\text{t}}}\) state and the backward hidden \(\overset{\leftarrow}{\text{H}_{\text{t}}}\) state. \[H_{t}=[\overset{\rightarrow}{H_{t}};\overset{\leftarrow}{H_{t}}] \tag{7}\]  
Two layers of BiLSTM are superimposed in our CLSTM-MT model, which can better enhance the learning ability of the network. The output of the first hidden state \(\text{H}_{\text{t}}\)(1) acts as the input of the second hidden state \(\text{H}_{\text{t}}\)(2). First Layer BiLSTM Output:  
\[H_{t}^{(1)}=[\overset{\rightarrow}{H_{t}};\overset{\leftarrow}{H_{t}}] \tag{8}\]  
Figure 3:0 LSTM model architecture diagram. Second Layer BiLSTM Output:  
Figure 3:1  
Finally, the output layer uses \(\text{H}_{t}^{(2)}\) from the second layer to compute the output \(\text{O}_{t}\):  
Figure 3:2  
Here, \(W_{hq}\) denotes the weight matrix that connects the hidden to the output, while \(\text{b}_{q}\) represents the bias term for the output.