## 2 Related Work  
In the literature, deep-learning-based methods dominated encrypted traffic classification tasks in recent years. Due to the advantages of automatically extracting discriminative features rather than relying on manual design, these methods can classify large amounts of encrypted traffic data. Hence, various deep-learning-based techniques were investigated in the literature to classify encrypted traffic. ICLSTM [9] uses long short-term memory networks (LSTMs), and ETCC [10] uses convolutional neural networks (CNNs) to automatically extract representations from raw packet size sequences of the encrypted traffic. CBD [11] is pre-trained with unlabeled data to classify encrypted traffic from the packet level and traffic level. However, these approaches rely on a large amount of balanced data, while the vast majority of datasets cannot meet this requirement. This phenomenon is observed in multiple fields such as banking fraud detection, medical diagnosis, especially in the field of the network security. In the face of these imbalanced datasets, the traditional deep-learning-based models will be biased towards the majority categories, and correspondingly, the minority categories will be ignored or even misclassified. Hence, for datasets with imbalanced categories, the classification performance of traditional deep-learning-based models is always poor.  
In imbalanced encrypted traffic classification, the methods used by researchers are divided into data-level methods, algorithm-level methods, and hybrid methods. Data-level methods reduce the imbalance and noise of data through various data sampling methods, such as over-sampling and under-sampling. [PERSON] [12] proposed to generate samples with similar statistical characteristics to other minority categories to build a balanced dataset. However, as the over-sampling method for resolving the imbalance problem involves repeatedly learning the same data, the classification model can overfit the learning data. Meanwhile, the under-sampling methods proposed to address the imbalance problem may cause information loss as they remove data from the original set. Without changing the data distribution, algorithm-level methods increase the emphasis on minority categories by adjusting learning styles or decision-making processes. [PERSON] [13] proposed to use a cost-sensitive learning method to increase the robustness of deep-learning classifiers against the class imbalanced problem in network traffic classification. [PERSON] [14] proposed to use random forest method for imbalanced traffic classification. It is compared with K-nearest neighbor and C4.5 decision tree algorithms, and the experimental results show that it can classify imbalanced encrypted traffic more effectively. Hybrid methods resample the data to reduce noise and imbalance, and then use algorithm-level methods to further reduce bias towards most classes. [PERSON] [15] introduces a combined over-sampling and under-sampling method based on the slow-start algorithm. Compared with synthetic minority over-sampling technique (SMOTE) and generative adversarial network over-sampling algorithms, the method improves the F1 score by 8.639% and 4.074%, respectively.