## 4 Method  
### Overview  
The findings from the preceding research and analysis highlight the critical role of base feature fusion and communication relationship mining in identifying encrypted malicious traffic. Building on this insight, this paper introduces a novel approach to feature representation learning for encrypted malicious traffic, termed the effective representation learning framework AFF_CGE. This framework integrates Attention-aware Feature Fusion (AFF) with Communication Graph Embedding Learning (CGE) to enhance detection capabilities. This approach advances the learning of feature representations for encrypted malicious traffic by thoroughly examining the internal characteristics and spatial relationships within network traffic. It enhances feature representation richness and depth through feature fusion while leveraging structural information between traffic flows via graph embedding techniques. The overall architecture of the AFF_CGE method proposed in this paper, illustrated in Figure 3, comprises two primary phases: encrypted traffic feature representation learning (Phase I) and detection model training (Phase II). In Phase I, the AFF and CGE mechanisms are employed to extract and fuse both the deep semantic and structural features of encrypted traffic, resulting in enriched feature representations. Phase II focuses on evaluating the effectiveness of these feature representations by applying various classifiers, ultimately constructing the final detection model. * Encrypted Traffic Data Preprocessing and Base Feature Extraction: Structured network traffic data are parsed from PCAP traffic files through session reconstruction. Each session's features are extracted and aggregated into IP-level features, resulting in a base feature vector \(x\in\mathbb{R}^{d_{x}}\) for each IP node, where \(d_{x}\) represents the dimensionality of the feature space. * Attention-Aware Feature Fusion (AFF): An attention mechanism is introduced to dynamically adjust the importance weights of the base features. This mechanism facilitates feature fusion by capturing the contribution of each feature to the identification of encrypted malicious traffic. Through nonlinear transformation and fusion of these features, the AFF mechanism generates feature representations \(z\in\mathbb{R}^{d_{z}}\), enriched with deep semantic information. * Communication Graph Embedding Learning (CGE): To capture the spatial relationships between communication nodes, the task of learning communication relationships in encrypted malicious traffic is reformulated as a graph embedding learning problem. CGE constructs a communication network graph based on IP nodes and leverages  
Figure 3: AFF_CGE method structure. graph convolutional networks (GCNs) to learn the structural relationships between nodes. This process yields feature representations \(f\in\mathbb{R}^{d_{f}}\) that integrate both the structural characteristics of the network and the underlying traffic data. * Feature Representation Learning Model Training: The feature representations \(f\), generated by AFF_CGE, are fed into a feed-forward neural network and classified via a softmax layer. The network's parameters are optimized using the backpropagation algorithm to minimize the training loss function, ensuring effective training and optimization of the feature representation learning model. It is noteworthy that, although the training in Phase I also aims to minimize the prediction loss of sample labels, its primary objective differs from that of Phase II. The main focus here is to generate more discriminative feature representations that are crucial for distinguishing between benign and malicious samples, rather than solely optimizing the detection performance as in Phase II.