## 3 Materials and Methods  
The proposed network intrusion detection framework of EFTransformer is shown in Figure 1. The EFTransformer consists of two main components: an encrypted traffic semantic consolidation module and a classifier. The traffic processing workflow includes three key stages: aggregation, clustering, and embedding. In the classifier, an adaptive attention pooling mechanism is employed to dynamically aggregate feature information. The mechanisms of each stage are illustrated in the following subsections with detailed workflow explanations and algorithms.  
The logistic description of each stage with symbolic expression is shown in Algorithm 1. Specifically, a packet \(p_{i}\) is the basic unit of network traffic, and is defined in Formula (1),  
Figure 1: Workflow and Framework of EFTransformer for Encrypted Traffic Analysis.  
where \(x_{i}\) is the quintuple (source IP, source port, destination IP, destination port, protocol), \(t_{i}\) is the timestamp, and \(c_{i}\) is the payload.  
\[p_{i}=(x_{i},t_{i},c_{i}) \tag{1}\]  
A flow \(f_{k}\) consists of a sequence of packets sharing the same quintuple within a time window is defined as in Formula (2), and all packets in \(f_{k}\) are ordered by time and represent unidirectional or bidirectional traffic sessions.  
\[f_{k}=\{p_{i}\mid x_{i}=x_{k}\wedge|t_{i}-t_{k}|<\Delta t\} \tag{2}\]  
A channel \(C_{m}\) groups flows by common IP pairs (source and destination IPs) as shown in Formula (3), where the IP pair is symmetric, allowing bidirectional flow grouping.  
\[C_{m}=\{f_{k}\mid ip_{src}(f_{k}),ip_{dst}(f_{k})\in\{IP_{m}^{(1)},IP_{m}^{(2)}\}\} \tag{3}\]  
Each channel is summarized by statistical metrics for downstream classification as a feature vector, as in Formula (4), which provides structured and compressed representations of traffic behavior.  
\[X_{m}=(\text{flow count},\text{avg}.\text{duration},\text{total payload}) \tag{4}\]  
```
0: Raw packet stream \(\mathcal{P}=\{p_{1},...,p_{n}\}\), time window \(\Delta_{max}\), DBSCAN params \((\epsilon,\mu)\)
0: Predicted labels \(\mathcal{Y}\)
1:Step 1: Traffic Aggregation
2: Extract quintuple \(\xi_{i}=(src\_ip,dst\_ip,src\_port,dst\_port,protocol)\) for each \(p_{i}\)
3: Group packets into flows \(f_{k}\) where \(\xi_{i}=\xi_{k}\) and \(|t_{i}-t_{i-1}|<\Delta_{max}\)
4: Merge flows into channels \(C_{m}\) by IP pair symmetry
5: Extract channel-level statistical features \(\mathbf{X}_{m}\)
6:Step 2: Adaptive Clustering
7: Apply DBSCAN: \(\mathcal{L}\leftarrow\text{DBSCAN}(\mathbf{X},\epsilon,\mu)\)
8: Reassign noise points (\(l_{i}=-1\)) to new class labels
9: Extract behavior sequences per cluster: \(\mathcal{B}_{k}=\{s_{pn},s_{iatt},s_{sp},s_{dp}\}\)
10: Balance cluster sample distribution
11:Step 3: Embedding
12:for each sequence type \(\tau\in\{pn,iatt,sp,dp\}\)do
13: Train Word2 Vec embedding: \(\mathbf{E}_{\tau}^{un2v}\)
14: Train FastText embedding: \(\mathbf{E}_{\tau}^{f_{t}}\)
15: Concatenate embeddings: \(\mathbf{E}_{\tau}\leftarrow[\mathbf{E}_{\tau}^{un2v}\oplus\mathbf{E}_{\tau}^{ f_{t}}]\)
16:endfor
17:Step 4: Classifier
18: Initialize input set \(\mathcal{I}=\{\mathbf{E}_{pn},\mathbf{E}_{iatt},\mathbf{E}_{sp},\mathbf{E}_{dp}\}\)
19: Encode each stream: \(\mathbf{H}_{\tau}\leftarrow\text{Encoder}(\mathbf{E}_{\tau})\)
20: Attention pooling: \(\mathbf{z}\leftarrow\sum_{\ell}\alpha_{\ell}\cdot\mathbf{H}_{\ell}\)
21: Predict class label: \(\mathcal{Y}\leftarrow\text{Classifier}(\mathbf{z})\)
22:return\(\mathcal{Y}\)
```  
**Algorithm 1** EFTTransformer progress