## 5 Experimental Results
### Comparison with Manual Feature Extraction Methods
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multicolumn{3}{c}{**Logistic Regression**} & \multicolumn{3}{c}{**Naive Bayes**} & \multicolumn{3}{c}{**KNN**} & \multicolumn{3}{c}{**Decision Tree**} & \multicolumn{3}{c}{**XGBoost**} \\ \cline{2-13}  & **PRE** & **REC** & **F1** & **PRE** & **REC** & **F1** & **PRE** & **REC** & **F1** & **PRE** & **REC** & **F1** & **PRE** & **REC** & **F1** \\ \hline BS-F & 0.809 & 0.811 & 0.810 & 0.796 & 0.912 & 0.850 & 0.878 & 0.832 & 0.854 & 0.865 & 0.583 & 0.696 & 0.913 & 0.811 & 0.859 \\ FM-F & 0.844 & 0.868 & 0.856 & 0.858 & 0.656 & 0.743 & 0.872 & 0.835 & 0.853 & 0.873 & 0.709 & 0.782 & 0.905 & 0.783 & 0.839 \\ EC-F & 0.843 & 0.749 & 0.793 & 0.782 & 0.825 & 0.803 & 0.876 & 0.836 & 0.855 & 0.889 & 0.700 & 0.783 & 0.873 & 0.687 & 0.769 \\ ALL-F & 0.869 & 0.825 & 0.846 & 0.839 & 0.846 & 0.842 & 0.880 & 0.866 & 0.873 & 0.891 & 0.732 & 0.803 & 0.907 & 0.781 & 0.839 \\ AFF\_CGE & 0.873 & 0.940 & 0.905 & 0.887 & 0.920 & 0.903 & 0.902 & 0.933 & 0.917 & 0.923 & 0.925 & 0.924 & 0.928 & 0.930 & 0.929 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparison of experimental results between AFF_CGE and manual feature extraction methods. offering a foundational session-level description. FM-F employs complex extraction techniques to uncover multi-dimensional features in network traffic. In contrast, EC-F targets content-specific features of encrypted communications, attempting to identify recognizable patterns in encrypted data. These observations highlight the inherent limitations of manual feature extraction methods, which often focus on specific aspects of the data, making it challenging to comprehensively capture the complex and varied behavioral patterns of encrypted traffic. Advantages of ALL-F: To address the limitations associated with individual feature sets, ALL-F integrates the feature information from BS-F, FM-F, and EC-F, creating a comprehensive benchmark model with 448-dimensional features. As presented in Figure 7, experimental results demonstrate that ALL-F consistently outperforms individual feature sets across all classifier types. Notably, with the decision tree (DT) classifier, the F1-score of ALL-F is 10.7 percentage points higher than that of BS-F. This substantial improvement underscores that incorporating a broader range of feature information enhances the model's classification performance. Superior Performance of AFF_CGE: As presented in Figure 7, compared to manual feature extraction methods, the AFF_CGE approach proposed in this study demonstrates substantial improvements across all metrics. Specifically, AFF_CGE outperforms BS-F by 5.3 to 22.8 percentage points when using BS-F as the sole input, and surpasses ALL-F by 4.4 to 12.1 percentage points. These results not only highlight AFF_CGE's superior feature extraction capabilities but also indicate its effectiveness in uncovering the deep semantics of encrypted traffic behaviors from underlying information. By automatically learning and integrating multiple feature types, AFF_CGE provides a more comprehensive and accurate representation of encrypted traffic behaviors, offering a novel approach and methodology for encrypted traffic analysis.