## 4 Method
### Encrypted Traffic Preprocessing
\begin{table}
\begin{tabular}{l l l l} \hline
**From** & **Feature Name** & **Type** & **Feature Description** \\ \hline \multirow{8}{*}{Session Base Features} & id.orig\_p & Categorical & Source IP address \\  & id.resp\_p & Categorical & Destination port number \\  & proto & Categorical & Protocol type \\  & service & Categorical & Service type \\  & conn\_state & Categorical & Connection state \\  & local\_orig & Categorical & Whether the source is local \\  & local\_resp & Categorical & Whether the destination is local \\  & history & Categorical & Connection history \\  & tunnel\_parents & Categorical & Tunnel parent nodes \\  & duration & Numerical & Connection duration \\  & orig\_bytes & Numerical & Bytes sent by the source \\  & resp\_bytes & Numerical & Bytes received by the destination \\  & missed\_bytes & Numerical & Missed bytes \\  & orig\_pks & Numerical & Number of packets sent by the source \\  & orig\_ip\_bytes & Numerical & IP layer bytes sent by the source \\  & resp\_pkts & Numerical & Number of packets received by the destination \\  & resp\_ip\_bytes & Numerical & IP layer bytes received by the destination \\ \hline \multirow{8}{*}{TLS Information} & version & Categorical & SSL/TLS protocol version \\  & cipher & Categorical & Encryption suite used for the connection \\  & server\_name & Categorical & Server Name Indication \\ \cline{1-1}  & resumed & Boolean & Indicates whether the SSL/TLS session was resumed \\ \cline{1-1}  & last\_alert & Categorical & The type of the last SSL/TLS alert \\ \cline{1-1}  & established & Categorical & Indicates if the SSL/TLS connection was successfully established \\ \cline{1-1}  & ssl\_history & Categorical & Records SSL/TLS connection events and state changes \\ \cline{1-1}  & cert\_chain\_fps & Categorical & Fingerprints of certificates in the server’s certificate chain \\ \hline \end{tabular}
\end{table} 
Table 1: Session-level base feature description. and prevent overfitting, the maximum number of TF-IDF features is capped at 48 in this paper. The TF-IDF calculation is given by the following formula:  
\[\text{TF-IDF}(t,ip)=\text{TF}(t,ip)\times\text{IDF}(t) \tag{2}\]  
where \(\text{TF}(t,ip)\) refers to the frequency of feature \(t\) appearing in the sessions under IP \(ip\), \(\text{IDF}(t)\) represents the inverse document frequency of feature \(t\) across all IPs. The inverse document frequency is defined as  
\[\text{IDF}(t)=\log\biggl{(}\frac{M}{1+|\{ip:t\in ip\}|}\biggr{)} \tag{3}\]  
where \(M\) is the total number of IPs, and \(|\{ip:t\in ip\}|\) is the number of IPs containing feature \(t\) (with 1 added to avoid division by zero). As an example, consider the session base features presented in Table 1, which consists of 17 session-level features. Eight of these are numerical features, which are aggregated into 32 IP-level features by calculating the mean, maximum, minimum, and standard deviation for each feature. The remaining nine categorical features are processed using the TF-IDF method, yielding 48 additional IP-level features. This results in a total of 80 IP-level features. Through this process, we transform the raw encrypted traffic data into structured IP-level features \(x\in\mathbb{R}^{d_{x}}\). These feature sets are then used as input for the Attention-Aware Feature Fusion (AFF) model in subsequent steps.