## 6 Conclusions  
This study proposes a novel architecture, EFTransformer, for encrypted malicious traffic detection, which integrates dual-semantic embedding, multi-dimensional feature encoding, and a self-attention mechanism. Experimental results demonstrate its robustness and reliability in complex encrypted environments. Overall, EFTransformer effectively addresses key challenges such as feature ambiguity, attack pattern diversity, and class imbalance. Its hybrid modeling framework--combining semantic representation, behavioral abstraction, and an adaptive attention mechanism--offers a scalable and deployable solution for encrypted traffic analysis. This work lays a solid foundation for future research on more lightweight and real-time detection systems and provides a structural blueprint for integrating LLM capabilities with fine-grained traffic behavior modeling. In future research, in the face of the continuous evolution of network threats and the rapid changes in the technology ecosystem, it is still necessary to deepen exploration in the following directions: First, in response to the lightweight deployment requirements of edge computing and IoT scenarios, it is necessary to further integrate model compression technology and hardware acceleration architecture and explore adaptive model optimization based on neural architecture search (NAS) to balance detection accuracy and real-time performance in resource-constrained environments. Secondly, with the emergence of AI-driven adaptive attack methods, an online incremental learning mechanism can be introduced to build a dynamic defense system so that the model can quickly identify unknown attack variants based on a small number of samples and reduce the dependence on labeled data. In addition, in order to address privacy compliance issues, it is necessary to explore federated learning and secure multi-party computing frameworks in the future, taking into account both detection efficiency and user privacy protection. At the technical integration level, digital twin technology can be combined to build a high-fidelity network simulation environment to simulate multi-dimensional attack scenarios to enhance the generalization ability of the model; at the same time, a causal reasoning mechanism can be introduced to analyze the potential correlation of the attack chain, thereby improving the threat tracing and blocking efficiency from the root. Finally, we will promote the intelligent collaboration of detection systems; combine traffic analysis with threat intelligence maps and user behavior modeling; build an integrated detection, response, defense ecosystem; and establish an industry-level benchmark testing platform and adversarial sample library to promote the robust iteration of algorithms in complex real-world scenarios. These directions will not only promote the paradigm upgrade of malicious traffic detection technology but also provide theoretical support and practical paths for building a new type of autonomous and evolving network security protection system. **Author Contributions**: Conceptualization, Z.D. and W.F. ; methodology, W.F. ; software, S.T. ; validation, S.T., F.D., and Z.D. ; formal analysis, S.T. ; investigation, S.T. ; resources, Z.D. ; data curation, S.T. ; writing--original draft preparation, S.T. ; writing--review and editing, F.D. and W.F. ; visualization, S.T. ; supervision, Z.D. and W.F. ; project administration, Z.D. and W.F. ; funding acquisition, W.F. All authors have read and agreed to the published version of the manuscript. **Funding:** This work was partially supported by the XJTLU AI University Research Center, Jiangsu Province Engineering Research Center of Data Science and Cognitive Computation at XJTLU, and SIP AI innovation platform (YZCXPT2022103). This work was also supported in part by XJTLU Research Development Funding (RDF-21-02-012) and XJTLU Teaching Development Funding (TDF21/22-R24-177). **Data Availability Statement**: Data available upon request due to restrictions.