## 1 Introduction  
The exponential growth of network traffic, driven by cloud computing, the internet of things (IoT), and mobile edge applications, has led to a dramatic increase in encrypted communication. According to Let's Encrypt, HTTPS usage ranged from 39% to over 80% between 2015 and 2019 [1, 2], while TLS 1.3 rapidly gained traction, being adopted in over 30% of all Chrome connections within a year [3]. In parallel, adversaries have advanced their tactics, leveraging encrypted channels to disguise attacks such as stealthy DDoS bursts, DNS over HTTPS (DoH), or lateral movement using zero-day exploits. These trends have rendered traditional plaintext-based detection approaches, such as deep packet inspection (DPI), increasingly ineffective under modern encryption protocols like TLS 1.3 and QUIC [4]. Despite decades of progress in traffic analysis, encrypted malicious traffic detection remains a fundamental unsolved challenge [5]. Traditional DPI techniques, which once dominated, have been ineffective due to encryption protocols that obscure payload content and prevent pattern matching [6; 7]. Although machine learning (ML) methods have emerged as promising alternatives [8; 9], they rely on statistical metadata rather than payloads, and they suffer from poor generalization in the presence of imbalanced labels and high FPR due to feature overlap between benign and malicious traffic. They have difficulty in capturing the long-range spatiotemporal semantics inherent in encrypted communications [10; 11; 12; 13]. While large language models (LLMs) can provide better contextual understanding, they introduce high computational costs and instability in practical deployments [4; 14; 15]. The key question is how to build a model that combines expressiveness and detection efficiency while reducing false positives and maintaining performance under encrypted, unbalanced, and dynamic traffic conditions. The limitations of traditional methods highlight the urgent need for a smarter and more adaptive detection framework. To this end, we are committed to designing a detection architecture that can parse cross-layer protocol semantics and adaptively learn evolving behavior patterns in long sessions. Our motivation, without the need to decrypt traffic, is to accurately identify advanced threats such as IoT malware, effectively reduce FPR and FNR, reduce the burden of manual verification, provide enterprises with more powerful encrypted traffic security monitoring capabilities, and comprehensively improve the level of network boundary protection. EFTransformer proposes an innovative solution to the above problems. To this end, we built a traffic aggregation and extraction framework based on quintuples to quantify network flow activities, characterize the temporal characteristics of traffic, identify service types and communication characteristics, and thus enhance the ability to understand complex attack behaviors. In order to improve the robustness of the model to noise, we improved the density-based adaptive spatial clustering algorithm (DBSCAN) and designed a noise redistribution mechanism to avoid the problem of valuable information loss caused by simply removing noise points. Subsequently, through the multi-feature semantic fusion mechanism, we broke through the limitation of traditional methods that only rely on shallow statistical features and were able to deeply explore the deep semantic information in encrypted traffic and the inherent logic of attack behaviors. The main contributions of this work are as follows:  
* By using quintuples, we propose a traffic aggregation extraction framework to quantify network flow activity, characterize traffic temporal patterns, and identify service types and communication features. * The adaptive density-based spatial clustering of applications with noise (DBSCN) clustering algorithm is improved, and a noise reallocation mechanism to enhance the model's tolerance for noise is designed, avoiding issues such as simply eliminating noise points and losing valuable information.