# A VPN-Encrypted Traffic Identification Method Based on Ensemble Learning
## 3 Example Analysis
### Experimental Analysis and Verification  
#### 3.2.1 Time-Related mRMR Feature Selection  
The use of the time-related mRMR feature selection method facilitates the removal of redundant and irrelevant features and enhances the model's understanding between features and feature values. Unimportant features are deleted according to their importance, and the importance of data features is shown in Table 3 and Figure 7.  
After the ranking of feature importance is obtained, feature selection needs to be performed. Too much or too little feature selection can have an impact on the accuracy of the model. Therefore, several different numbers of features \(n\) are chosen and passed through several Experiments. The effect of different \(n\) values on the Accuracy value of the model is compared each time, and the best number of features \(n\) is selected from them. The effect of the features number on the accuracy of the model is shown in Table 4 and Figure 8. \begin{table}
\begin{tabular}{c c} \hline \hline
**Traffic** & **Content** \\ \hline Browsing & Firefox and Chrome \\ Email & SMPTS, POP3S and IMAPS \\ Chat & ICQ, AIM, Skype, Facebook and Hangouts \\ Streaming & Vimero and Youtube \\ File Transfer & Skype, FTPS and SFTP \\ VolP & Facebook, Skype, and Hangouts \\ P2P & Utorrent and Transmission \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The traffic classes and traffic content. \begin{table}
\begin{tabular}{c c} \hline \hline
**Feature** & **Description** \\ \hline Duration & The duration of the flow. \\ FAT & Forward Inter Arrival Time, the time between two packets sent forward direction (mean, min, max, std). \\ BAT & Backward Inter Arrival Time, the time between two packets sent backward (mean, min, max, std). \\ Flow-IAT & Flow Inter Arrival Time, is the time between two packets sent in either direction (mean, min, max, std). \\ Active & The amount of time a flow was active before going idle (mean, min, max, std). \\ Idle & The amount of time a flow was idle before becoming active (mean, min, max, std). \\ FB-psec & Flow Bytes per second. \\ FP-psec & Flow packets per second. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The time-related features and their descriptions. Figure 6: Encrypted traffic capture path. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature Number** & **Feature Name** & **Importance Ordering** \\ \hline
0 & duration NUMERIC & 18 \\  
td\_idle NUMERIC & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The importance of data features. Figure 7: Importance of data features. From the experimental results, when the number of features is \(n=20\), the accuracy obtained by using xgboost is the highest. At the same time, the feature redundancy is the lowest. Therefore, the feature number \(n\) is selected as 20 in this paper. According to Table 4, the selected features are the top 20 comprehensively ranked features. We verify the importance of the top 20 features of the composite ranking, as shown in Figure 9.  
The encrypted traffic data features before mRMR feature selection are selected to generate a heat map about the correlation coefficients between different features. We verify the correlation of encrypted traffic features before and after feature selection, as shown in Figures 10 and 11.