## 1 Introduction  
With the rapid development of online applications, the composition of the flow rate is also richer, such as streaming media, instant messaging, online games, etc. Every day, new applications appear and generate network traffic. Meanwhile, newly emerging encrypted techniques are used to protect the privacy of users. However, various cyberattacks pose enormous challenges to network security monitoring. In order to manage the network, it is necessary to classify network traffic through technical methods and obtain relevant information [1].  
Traditional traffic classification methods are mainly divided into four categories [2]: port-based, deep packet inspection (DPI), machine learning, and deep learning. With the rapid growth of port camouflage [3], port randomization [4], and tunneling technology [5], the port-based method is quickly invalidated. The DPI-based methods patterns the packets, and then classifies the traffic based on different matching characteristics [6]. However, these methods have a high complexity, thus, it cannot be applied to the encrypted traffic. Machine-learning methods do not require parsing data inside traffic, which can simplify the computational complexity. These methods rely highly on the design of features sets, which directly affect the classification performance, and require a suitable dataset for classification [7]. To tackle the above problems, research in encrypted traffic classification evolved significantly over time. Recently, deep-learning methods automatically learn layer-by-layer from the raw traffic, and classify them based on the generated high-level features. Although promising results were achieved, the classification precision of minority categories is still low, due to the imbalanced distribution of encrypted traffic data [8].  
In this paper, we improve the classification accuracies of minority categories by solving the problems caused by an imbalanced dataset. These problems are currently solved mainly by using over-sampling methods such as synthetic minority over-sampling technique (SMOTE). However, the data it generates may not be sufficiently realistic. To handle the classification problems caused by imbalanced data categories, and improve the classification performance of these categories, we propose a new imbalanced encrypted traffic classification model based on CBAM-CEFL. The experiments are conducted on the public dataset ISCX Tor 2016 that contains more than 18 representative applications of Tor and non-Tor encrypted traffic data.  
The main contributions of this paper are summarized as follows:  
* We propose a redefined imbalance degree for imbalanced encrypted traffic datasets, and take it as the indicator to construct a weight function to reassign the weights of each category;
* According to the performance tendency problems caused by imbalanced datasets, we propose a re-weighted CEFL loss function to expand the inter-class distance and increase the effective loss gap between the majority and minority samples;
* We improved the channel attention module (CAM) in CBAM with the redefined imbalance degree, which can make the model pay more attention to the characteristics of the minority categories, and increase the representation ability of these samples.