## 5 Experimental Results
### Ablation Experiment  
The experiment designs the synergy of components such as the multi-head attention mechanism, the feature fusion layer, attention pooling, and the residual link. We design ablation experiments of different modules to highlight the effects of different components and embeddings, as shown in Table 4. This ablation study highlights the core components of EFTransformer by systematically evaluating the impact of removing key architectural modules. Notably, removing the multi-head attention module results in the most significant drop in accuracy, suggesting that it plays a crucial role in capturing diverse and global dependencies in encrypted traffic. The feature fusion layer is also critical as it enables the interaction of multiple behavioral channels, helping to unify the representation of network activity. Attention pooling enhances temporal focus and interpretability, especially in identifying short-lived or sparse anomalies. Residual connections, while often overlooked, have been shown to support stable training and deep feature extraction. In addition, the performance of single-feature encoder variants drops significantly, further demonstrating the value of multi-semantic encodings. Taken together, these findings validate that each module of EFTransformer plays a synergistic role in achieving high-accuracy detection of complex encrypted traffic patterns. \begin{table}
\begin{tabular}{l c c c c c c} \hline \hline
**Model Variant** & **Accuracy** & **Precision** & **Recall** & **F1 Score** & **FPR** & **FNR** \\ \hline EFTransformer (Ours) & 95.26\% & 92.30\% & 94.15\% & 95.12\% & 6.19\% & 5.85\% \\ Remove Multi-Head Attention & 89.43\% & 88.00\% & 90.46\% & 89.21\% & 10.57\% & 9.54\% \\ Remove Feature Fusion Layer & 91.28\% & 89.50\% & 92.77\% & 91.12\% & 8.72\% & 7.23\% \\ Remove Attention Pooling & 93.12\% & 91.80\% & 94.18\% & 92.98\% & 7.88\% & 5.82\% \\ Single Feature Encoder & 87.56\% & 86.10\% & 88.61\% & 87.34\% & 12.44\% & 11.39\% \\ No Residual Connection & 90.42\% & 88.90\% & 91.69\% & 90.28\% & 9.78\% & 8.31\% \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Performance Comparison of different model variants. Ablation experiments validate the critical design choices in EFTransformer. As shown in Table 4, the complete model achieves 95.26% accuracy, a 6.19% FPR, and a 95.12% F1 score, significantly outperforming all its variants. Among the ablations, removing the multi-head attention module causes the most substantial drop in accuracy, down 5.83%, underscoring its essential role in capturing global and diverse dependency patterns across feature subspaces. This model enables us to effectively capture intricate behavioral correlations embedded in encrypted traffic. The feature fusion layer is another cornerstone of the architecture. Its removal leads to a 3.98% decrease in accuracy. This layer aggregates information from four parallel behavior encoding channels, allowing cross-feature interaction and enhancing the model's ability to capture complementary patterns. Without this fusion, the model struggles to form a unified understanding of network behavior. The attention pooling mechanism, while less impactful in terms of absolute accuracy loss (2.14%), plays a unique role in refining feature representation. By computing importance weights over sequence positions, it enables the model to focus on key temporal segments and suppress irrelevant or redundant information. Attention Pooling dynamically calculates the attention weight of the output of each time step in the input feature sequence. This means that the model can adaptively evaluate the contribution of the feature content at each moment to the overall behavior, thereby focusing on key time segments rather than looking at all time steps equally. Compared with average pooling and maximum pooling, attention pooling retains the information of multiple key time segments through weighted fusion and gives them higher expression priority.