## 5 Experimental Results
### Parameter Selection Strategy
#### 5.2.2 Embedding Size  
We use different embedding strategies based on dimensionality to optimize model performance, as shown in Table 3. For 64- and 128-dimensional embeddings, we exclusively employ Word2 Vec. For 256-dimensional and higher configurations, we combine Word2 Vec and FastText to enhance feature representation. In lower-dimensional spaces, the constrained vector space may lead to feature interference between models, resulting in mutual exclusion effects when applying dual embeddings. Consequently, we exclusively employ the Word2 Vec strategy in this dimensional range. When the dimensionality exceeds 128, Word2 Vec exhibits performance saturation, whereas the expanded vector space enables FastText to effectively complement the representation with subword-level features, ultimately enhancing the model's overall ability. The concatenated vectors form a 384-dimensional comprehensive representation, retaining both the flow-level semantic context and substructure local features. Figure 6: Results on the Eps and noise point of clustering. The 384-dimensional embedding achieves an optimal trade-off between detection performance and computational efficiency. It yields an accuracy of 95.26% and an F1 score of 95.12%, indicating robust discriminative capability. This performance stems from the embedding's capacity to capture both global semantic dependencies and fine-grained local structures in the traffic data through the complementary encoding strengths of Word2 Vec and FastText. The dual-channel embedding of 384 dimensions plays a key role in reducing false positives and false negatives while maintaining a high overall accuracy. It significantly reduces the false positive rate of the FPR to 6.19% and the FNR to 5.85% compared to using word2 vec alone in low dimensions. Although 512 dimensions achieves better metrics (FPR: 5.48%, and FNR: 2.71%), it comes with a higher computational cost. Therefore, the 384-dimensional embedding provides the best balance, ensuring efficiency while providing enough capacity to capture semantic and structural patterns and minimize the risk of misclassification in encrypted traffic detection. In terms of resource overhead, the 384-dimensional configuration maintains real-time applicability as shown in Figure 7, with an inference time of 47.3 ms and a model size of 156 MB at an average batch size of 128. Compared to the 512-dimensional configuration, which only improved accuracy by 0.46%, the 384-dimensional version avoids unnecessary computational costs. Specifically, increasing to 512 dimensions results in a 23.5% increase in inference time from 47.3 ms to 58.4 ms, as well as a 31% increase in memory consumption, which significantly affects the feasibility of deployment in resource-constrained or edge environments. The 256-dimensional embedding provides a lightweight alternative, achieving 94.1% accuracy in an inference time of 35.2 ms, making it more suitable for latency sensitive scenarios. In addition, the dual embedding strategy improves the ability to express features compared to a single Word2 Vec model. For example, FastText can effectively capture the relationship between digital tokens and better identify the similarity between port numbers \"80\" and \"8080\", while Word2 Vec can better model temporal dependencies, such as packet \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Embedding Size** & **Accuracy** & **Precision** & **Recall** & **F1 Score** & **FPR** & **FNR** \\ \hline
64 & 87.34\% & 85.70\% & 88.34\% & 87.01\% & 12.68\% & 11.66\% \\
128 & 91.16\% & 89.40\% & 92.66\% & 91.02\% & 10.66\% & 7.34\% \\
256 & 93.42\% & 92.90\% & 93.66\% & 93.28\% & 7.24\% & 6.34\% \\
384 & 95.26\% & 92.30\% & 94.15\% & 95.12\% & 6.19\% & 5.85\% \\
512 & 95.72\% & 94.10\% & 97.29\% & 95.68\% & 5.48\% & 2.71\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Performance comparison under different embedding sizes. Figure 7: Comparison of different embedding sizes. arrival intervals.