## 5 Experimental Results
### Evaluating Model Generalization Across Diverse Datasets  
To assess the generalization performance of our proposed method in identifying new encryption technologies or attack behaviors, we conducted experiments on two different datasets. In addition to the Datacon dataset, we adopted the ISCX dataset [27], a public dataset that includes various botnet communications, featuring multiple command and control (C&C) communication types, such as SSH, TLS, and malware-customized encrypted traffic. We set up two sets of comparative experiments on both datasets. By comparing the baseline model with the AFF_CGE model, we aimed to analyze whether AFF_CGE demonstrates performance improvements across different datasets and assess its generalization capability. * Baseline Model: This model is built using the traditional BS-F feature set, which is directly input into various conventional machine learning classifiers (e.g., LR, NB, KNN, DT, XGBoost) for training. * AFF_CGE Model: This model is developed on the BS-F feature set and utilizes the integrated AFF_CGE module for further semantic learning of features, generating new representations of encrypted traffic features for training the classifiers. The experimental results, as shown in Table 6, indicate that the features learned through the AFF_CGE module outperform the baseline model that uses the original feature set across all classifiers in the Datacon dataset, with an F1-score improvement ranging from 5.3% to 22.9%. Similarly, in the ISCX dataset, the features processed by the AFF_CGE module exhibited superior performance in most classifiers, particularly in logistic regression and Naive Bayes models, with improvements of 14.3% to 23.4%. These results strongly demonstrate the robust generalization capability of the AFF_CGE method for encrypted traffic feature learning, maintaining stable performance across different network environments. This not only validates the effectiveness of the AFF_CGE method but also suggests its applicability in detecting new encryption technologies or attack behaviors. \begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**DataSet**} & \multirow{2}{*}{**Model**} & \multicolumn{3}{c}{**Logistic Regression**} & \multicolumn{3}{c}{**Naive Bayes**} & \multicolumn{3}{c}{**KNN**} & \multicolumn{3}{c}{**Decision Tree**} & \multicolumn{3}{c}{**XGBoost**} \\ \cline{3-14}  & & **PRE** & **REC** & **F1** & **PRE** & **REC** & **F1** & **PRE** & **REC** & **F1** & **PRE** & **REC** & **F1** & **PRE** & **REC** & **F1** \\ \hline \multirow{3}{*}{Datacon} & Baseline & 0.809 & 0.811 & 0.810 & 0.796 & 0.912 & 0.850 & 0.878 & 0.832 & 0.854 & 0.865 & 0.583 & 0.696 & 0.913 & 0.811 & 0.859 \\ \cline{2-14}  & AFF\_CGE & 0.873 & 0.940 & 0.905 & 0.887 & 0.920 & 0.903 & 0.902 & 0.933 & 0.917 & 0.923 & 0.925 & 0.924 & 0.928 & 0.930 & 0.929 \\ \cline{2-14}  & Rise & +0.064 & +0.129 & +0.095 & +0.091 & +0.008 & +0.053 & +0.024 & +0.101 & +0.063 & +0.058 & +0.342 & +0.229 & +0.015 & +0.119 & +0.070 \\ \hline \multirow{3}{*}{ICX} & Baseline & 0.898 & 0.761 & 0.824 & 0.688 & 0.966 & 0.803 & 0.965 & 0.966 & 0.976 & 0.971 & 0.973 & 0.987 & 0.984 & 0.985 \\ \cline{1-1} \cline{2-14}  & AFF\_CGE & 0.903 & 0.995 & 0.947 & 0.905 & 0.993 & 0.946 & 0.964 & 0.997 & 0.980 & 0.964 & 0.996 & 0.980 & 0.965 & 0.997 & 0.981 \\ \cline{1-1} \cline{2-14}  & Rise & +0.005 & +0.234 & +0.123 & +0.217 & +0.027 & +0.143 & \(-0.001\) & +0.031 & +0.015 & \(-0.012\) & +0.025 & +0.007 & \(-0.022\) & +0.013 & \(-0.004\) \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Generalization performance of AFF_CGE on diverse datasets.