# A VPN-Encrypted Traffic Identification Method Based on Ensemble Learning
## 3 Example Analysis
### Experimental Analysis and Verification
#### 3.2.3 Performance Analysis and Comparison of FL-XGB-Encrypted Traffic Identification Model  
We use Support Vector Machine (SVM), Gradient Boosting Decision Tree (GDBT), Naive_Bayes (NB), Logistic Regression (LR), K-nearest neighbor (KNN), Adaptive Boosting (Adaboost), Linear Discriminant Analysis (LDA), FL_XGB a total of 8 algorithms to identify the VPN traffic data, and then the four metrics Accuracy, Precision, Recall, F1-Score are output. The identification results are shown in Table 8.  
The performance comparison results of each algorithm under the indicators of Accuracy, Precision, F1-Score, and Recall are shown in Figure 16.  
From Figure 16, it can be seen that the FL-XGB-VPN-encrypted traffic identification method based on Time-Related mRMR feature selection, FL-XGB traffic identification model construction, and optimization proposed in this paper achieves an identification rate of more than 97%. In VPN-encrypted traffic identification, the model improves the accuracy by 8.21% over the traditional Xgboost identification model. In addition, the feature selection stage of the FL-XGB-VPN-encrypted traffic identification model preserves the attributes of the original features while ensuring the dimensionality reduction effect. The method maintains key features of the data and provides a basis for analyzing key features of VPN-encrypted traffic. In the parameter optimization stage of the identification model, our approach avoids large-scale searches while allowing the model to converge quickly to the optimal solution. It can be seen that the FL-XGB-VPN-encrypted traffic identification model has high identification ability and promotion ability. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Algorithm** & **ACC** & **Precision** & **F1-Score** & **Recall** \\ \hline SVM & 0.5169 & 0.5374 & 0.3361 & 0.3271 \\ GDBT & 0.8666 & 0.8626 & 0.8521 & 0.8475 \\ NB & 0.3093 & 0.3685 & 0.2691 & 0.3379 \\ LR & 0.4548 & 0.3489 & 0.2977 & 0.3126 \\ KNN & 0.8575 & 0.8553 & 0.8433 & 0.8416 \\ Adaboost & 0.5408 & 0.5224 & 0.4545 & 0.4913 \\ LDA & 0.4623 & 0.4153 & 0.2841 & 0.2892 \\ FL-XGB & 0.9743 & 0.9722 & 0.9703 & 0.9796 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Identification results of different algorithms. Figure 15: ROC curve. Based on the above results, to verify the universality of the FL-XGB-encrypted traffic identification model, another dataset is used for verification. On the ISCXTor2016 [36] dataset, compare the identification performance of the FL-XGB-encrypted traffic identification model with a total of 8 algorithms including SVM, GDBT, Naive_Bayes, LR, KNN, Adaboost, LDA, and C4.5 for Tor-encrypted traffic data. The four indicators of Accuracy, Precision, Recall, and F1-Score of the 10S feature data of the dataset Scenario-B file are shown in Table 9.  
The performance comparison of the FL-XGB-encrypted traffic identification model with other eight algorithms for four metrics, namely Accuracy, Precision, F1-Score, and Recall, is shown in Figure 17. Each performance of the FL-XGB-encrypted traffic identification model reaches above 0.995. As shown in Table 9, the average Accuracy value of other machine learning algorithms is 0.6955, the average Precision value is 0.6171, the average F1-Score value is 0.5971, and the average Recall value is 0.6319. The FL-XGB-encrypted traffic identification model has an average improvement of 30.05% in Accuracy value, 37.88% in Precision value, 39.92% in F1-Score value, and 36.47% in Recall value compared to the other 8 algorithms. Precision, F1-Score, and Recall are important indicators of the precision, false positives, and stability of the model performance. Therefore, the FL-XGB-encrypted traffic identification model has higher accuracy and more stable model performance in  
Figure 16: Performance comparison chart of different algorithms.