## 3 Materials and Methods
### Clustering  
The detailed process of clustering is shown in Figure 2 and Algorithm 2. Firstly, we slice the original network traffic according to a sliding time window of fixed length to maintain the temporal continuity and local context integrity of the feature pattern. This step not only limits the input range of the clustering operation, but also improves the computational efficiency. Next, we introduce the noise-aware density clustering algorithm based on local density differences (DBSCAN), and dynamically and adaptively adjusted the core parameters Eps in combination with the traffic density distribution, so that the algorithm still has good clustering ability and generalization performance in the face of mixed traffic scenarios with different attack intensities and different communication frequencies. Compared with the limitations of traditional DBSCAN in traffic pattern recognition under fixed parameters, our architecture improves the accuracy of clustering in identifying malicious traffic.  
After completing the preliminary clustering, we modeled the channel-level structure of the traffic within each cluster. Based on the traffic data after the flow channels were merged, the traffic records in each channel were arranged in chronological order, and a set of key  
Figure 2: Adaptive clustering processing. (Adaptive part: Encrypted streams are first grouped by their cluster labels, and category counts are balanced to prevent bias. The time-series data is then chronologically sorted, and each stream’s dominant cluster label is identified. Finally, key behavioral patterns such as PN, IAT, SP, and DP are extracted for subsequent modeling).  
attributes describing the dynamic characteristics of the behavior were extracted: number of packets (PN), inter-arrival time (IAT), source port number (SP) and destination port number (DP). These features respectively describe the communication frequency, rhythm change and target orientation of the attack traffic, and have good behavior discrimination capabilities. To construct the final feature pattern sample, we spliced the sequences of all channels in the cluster in the time dimension to form a comprehensive feature expression pattern at the cluster level. This splicing process not only retains the continuity of the attack behavior within the channel, but also reveals the stage evolution path of the attack through time alignment across channels. In addition, we also introduced a behavior consistency measurement indicator based on sequence statistical characteristics to evaluate and screen each cluster, and eliminate low-quality clusters with highly discrete internal feature distribution or mixed multiple behavior patterns to ensure the label consistency and semantic purity of the final sample set.  
```
0: Input traffic \(T\), window size \(W\), neighborhood radius (Eps) \(\epsilon\)
0: Structured feature pattern channel \(P\)
1:Phase 1: Preprocessing
2: Filter noise points from traffic data \(T\).
3:Phase 2: Cluster Analysis
4: 21: Group encrypted streams by cluster assignment;
5: 2.2: Balance cluster category distribution;
6: 2.3: Sort time series data chronologically;
7: 2.4: Extract the dominant label for each cluster.
8:Phase 3: Temporal Segmentation
9: Segment traffic into time windows \(\{w_{1},w_{2},...,w_{n}\}\) of length \(W\).
10:Phase 4: Feature Pattern Construction
11: 4.1: For each cluster \(c_{i}\), extract the following channel feature vectors:
12: \(\mathbf{f}_{i,j}=[PN_{j},IAT_{j},S\mathbf{f}_{j},DP_{j}]\), \(\forall\) channel \(j\in c_{i}\);
13: 4.2: Align features temporally to form pattern matrix \(\mathbf{M}_{i}\);
14: 4.3: Compute consistency metric \(\delta_{i}=\Phi(\mathbf{M}_{i})\);
15: 4.4: If \(\delta_{i}>\tau\), add pattern to result set \(P\).
16:Phase 5: Channel Integration
17: Merge related channels and eliminate redundancies.
18:return\(P\)
```  
**Algorithm 2** Adaptive clustering for encrypted traffic