## 5 Experimental Results
### Comparison with Other Representation Learning Methods  
In this paper, we conduct a comprehensive comparison of the AFF_CGE method against traditional machine learning models--including logistic regression, Naive Bayes, K-nearest neighbors (KNN), decision trees, and XGBoost--as well as deep learning approaches such as deep neural networks (DNNs), Convolutional Neural Networks (CNNs), and Long Short-Term Memory (LSTM) networks. Additionally, we assess state-of-the-art techniques like Graph Transformer Networks (GTNs [25]) and Graph Convolutional Networks for Encrypted Traffic Analysis (GCN-ETA [26]). Our systematic evaluation focuses on their effectiveness in capturing and interpreting the complex features of encrypted traffic through a series of comparative experiments. This study includes four sets of experiments:  
Figure 7: Comparison with manual feature extraction methods. (1) Traditional machine learning models (T-ML): Taking the base features (BS-F) as the detection features, detection models were constructed using traditional machine learning classifiers. * BS-F + X: The base feature set (BS-F) is directly input into different traditional machine learning classifiers (X) for training. The classifiers employed include logistic regression, Naive Bayes, K-nearest neighbors (KNN), decision trees, and XGBoost. (2) Deep learning models: We employed various deep learning models to extract novel feature representations from the base features (BS-F). Building on these new representations, we constructed a final detection model that integrates several classifiers, including logistic regression, Naive Bayes, K-nearest neighbors (KNN), decision trees, and XGBoost. * DNN + X: This approach uses a deep neural network (DNN) to process BS-F features, facilitating the fusion of diverse basic features. This fusion results in new feature representations of encrypted traffic, which are subsequently trained with various classifiers (denoted as X). * CNN + X: In this method, a Convolutional Neural Network (CNN) processes BS-F features to enhance the extraction of spatial characteristics. The CNN produces new feature representations of encrypted traffic, which are then trained with different classifiers (labeled as X), utilizing the refined spatial information. * LSTM + X: This technique employs a Long Short-Term Memory (LSTM) network to process BS-F features, enabling robust extraction of temporal characteristics. The LSTM generates novel feature representations of encrypted traffic, which are trained with various classifiers (denoted as X), capturing temporal dependencies in the data. (3) State-of-the-art models: We evaluate state-of-the-art models such as GTN and GCN-ETA, which are specifically tailored for encrypted traffic analysis. * GTN + X: A Graph Transformer Network (GTN) is applied to process BS-F features, generating new feature representations of encrypted traffic that are then trained with different classifiers (X). GTN handles graph data with complex node relationships, dynamically creating and synthesizing diverse graph structures for analysis. * GCN-ETA: BS-F features are processed by a graph convolutional network (GCN) and its extended model GCN-ETA, which learns to generate new encrypted traffic feature representations for training with classifier (X). GCN-ETA improves the traditional GCN's representation learning by using fixed-weight matrices as a single unit between layers, enhancing its capability with multiple edge types. (4) Our proposed AFF_CGE model:
* AFF_CGE+X: BS-F features are processed by the integrated AFF_CGE model to produce a new feature representation of encrypted traffic, which is then used for training with classifiers (X). The experimental results are presented in Table 5. The F1-scores for traditional machine learning classifiers range from 0.696 to 0.859, while deep learning methods achieve F1-scores between 0.848 and 0.903. For GTN, the F1-scores are between 0.903 and 0.926. GCN-ETA shows a wider range, from 0.202 to 0.934.