## 4 Method
### Communication Graph Embedding Learning (CGE)  
To accurately detect encrypted malicious traffic, relying solely on the internal features of the traffic is insufficient for identifying malicious behavior with precision. Building on the feature matrix \(Z\), generated through the Attention-aware Feature Fusion (AFF) mechanism, we further introduce a Communication Graph Embedding Learning method (CGE), based on a graph neural network (GNN). The purpose of CGE is to enhance detection accuracy by analyzing the relationships between samples, particularly the associations within network traffic. CGE enables the learning of both the structural and attribute information embedded within the network traffic, thereby producing a representative vector for each node in the graph. In network communication, traffic flows represent unidirectional data streams from a source IP address to a destination IP address. To leverage the structural relationships in communication graphs for encrypted traffic feature representation learning, this paper constructs a graph model based on traffic trajectories. The learning process of CGE is illustrated in Figure 5. Specifically, we define the communication relationships between IPnodes as a graph \(G=(V,A)\), where \(V\) is a set of vertices \(\{v_{1},v_{2},\ldots,v_{n}\}\), with each vertex representing an IP-level sample. The adjacency matrix \(A\in\mathbb{R}^{n\times n}\) is symmetric (typically sparse), and the matrix element \(a_{ij}\) indicates the edge weight between node \(v_{i}\) and node \(v_{j}\). If \(a_{ij}=0\), there is no edge between the two nodes, where the presence of an edge implies that both nodes, as source IPs, have communicated with the same destination IP. Additionally, we define the degree matrix \(D=\text{diag}(d_{1},d_{2},\ldots,d_{n})\), which is a diagonal matrix where each diagonal element \(d_{i}\) is the sum of the \(i\)-th row of the adjacency matrix, i.e., \(d_{i}=\sum_{j}a_{ij}\). Each node \(v_{i}\) in the graph corresponds to a feature vector \(z_{i}\in\mathbb{R}^{d_{z}}\), where the feature vectors of all nodes form a complete feature matrix \(Z=[z_{1},z_{2},\ldots,z_{n}]^{T}\in\mathbb{R}^{n\times d_{z}}\). To effectively learn features in this graph structure, we update the feature representation of each node by aggregating information from its neighboring nodes, capturing the structural relationships within the communication graph. Specifically, we employ a graph convolutional network (GCN) to capture local features of nodes and the structural relationships between nodes. The hidden layer of the GCN can be written as  
\[H^{(k+1)}=\mathcal{F}(H^{(k)},A) \tag{12}\]  
where the initial node input features are \(H^{(0)}=Z\), and \(\mathcal{F}\) represents a propagation rule, which can be simplified as a traditional feed-forward neural network function. In each layer, the GCN applies the propagation rule \(\mathcal{F}\) to merge information from neighboring nodes, forming the next layer's features. In this way, a convolution operation captures first-order neighbor information in each successive layer, and by stacking multiple GCN layers, multi-hop node information can be integrated. Through the linear transformations and nonlinear activations in the graph convolution layers, the feature propagation rule can be expressed as  
\[H^{(k)}=\text{ReLU}\Big{(}SH^{(k-1)}W^{(k)}\Big{)} \tag{13}\]  
where \(S=D^{-\frac{1}{2}}AD^{-\frac{1}{2}}\) is the normalized adjacency matrix, and \(W^{(k)}\in\mathbb{R}^{d\times d^{\prime}}\) is the trainable weight matrix for the \(k\)-th layer. With each layer of convolution, the model can capture both local neighbor features and global structural information.