## 6 Conclusions  
In conclusion, the AFF_CGE framework presented in this paper represents a significant advancement in the field of encrypted traffic analysis for detecting malicious activities. By harnessing the capabilities of deep learning and graph neural networks, our method has demonstrated remarkable performance gains over traditional approaches, achieving state-of-the-art results in terms of F1-score. The innovative integration of Attention-aware Feature Fusion (AFF) and Communication Graph Embedding Learning (CGE) enables AFF_CGE to extract deep, discriminative features from encrypted traffic data while capturing the intricate relationships between flows within the broader network context. This holistic approach not only captures the nuanced details within individual flows but also reveals broader patterns emerging from their interactions, enhancing the model's ability to discern malicious from benign traffic. Our experimental results, showing consistent performance improvements across various classifiers, underscore the versatility and robustness of AFF_CGE in real-world scenarios. It is important to note that privacy challenges represent a significant issue in the analysis of encrypted traffic. Although the content of the traffic is encrypted, analyzing encrypted data can still inadvertently reveal user identities through specific patterns or behavioral characteristics, leading to potential privacy concerns. Traditional methods for detecting malicious encrypted traffic typically involve extracting a large number of behavioral features, including some plaintext information exchanged during the handshake of encryption protocols such as TLS. This could allow attackers to infer user identities or roles, thereby posing substantial privacy risks. Figure 8: Comparison results of adversarial sample attacks. In contrast, the proposed AFF_CGE method requires only minimal session-based information and leverages the AFF and CGE modules to automatically learn and generate new effective features. This approach significantly reduces the need to extract extensive behavioral characteristics, thereby mitigating the risk of privacy breaches. Consequently, compared to traditional methods, our proposed approach offers a clear advantage in safeguarding user privacy. Beyond the technical contributions, this work also provides valuable insights into the design of future security systems capable of navigating the complex landscape of encrypted malicious activities. As encryption becomes increasingly ubiquitous, our framework offers a promising solution for maintaining network security and integrity, despite the challenges posed by encrypted traffic. In summary, the AFF_CGE framework represents a step forward in encrypted traffic analysis, setting a new benchmark for performance and inspiring further research in this critical domain. Methodology, G.S. ; software, J.L. ; validation, G.S. and J.L. ; writing--original draft preparation, J.L. ; writing--review and editing, G.S., H.R., X.L. and X.H. ; supervision, G.S. ; project administration, G.S. ; funding acquisition, G.S. and X.L. All authors have read and agreed to the published version of the manuscript. This work was supported in part by the National Natural Science Foundation of China (Grant No. 62362049, 62402205, 62262023), the Natural Science Foundation of Jiangxi Province of China (Grant No. 20232 BAB212009, 20242 BAB25065), the Key Laboratory of Data Protection and Intelligent Management, Ministry of Education, Sichuan University (Grant No. SCUSAKFFT202307Y), the Jiangxi Provincial Key Laboratory of Data Security Technology (Grant No. 2024 SSY03181), and the Finance Science and Technology Special \"Contract System\" Project of Jiangxi Province (Grant No. ZBG20230418014). The research employed a dataset that encompasses traffic information gathered from both malicious and benign software applications, spanning the period from February to June 2020.