## 5 Experimental Results
### Experimental Setup  
Data Source and Statistics: The dataset [24] utilized in this study comprises traffic data collected from malware and benign software between February and June 2020. The data were generated using the Tianqiong sandbox at Qi'anxin Technology Research Institute. Malicious traffic in this dataset refers to encrypted traffic produced by malware (all executable types), while benign traffic pertains to encrypted traffic generated by legitimate software (all executable types). The traffic consists of TLS/SSL data packets transmitted via port 443.  
The dataset includes 10,000 packet capture (PACP) files, with an equal distribution of malicious and benign traffic. Summary statistics for the dataset are presented in Table 2.  
Baselines: To assess the effectiveness of the AFF_CGE method, this study evaluated its performance using a range of traditional machine learning classifiers, including logistic regression, Naive Bayes, K-nearest neighbors, decision trees, and XGBoost.  
1. Logistic Regression (LR): Train the logistic regression classifier directly on the provided network traffic features.
2. Naive Bayes (NB): Train the Bernoulli Naive Bayes classifier directly on the provided network traffic features.
3. K-nearest Neighbors (KNN): Train the K-nearest neighbors classifier directly on the provided network traffic features.
4. Decision Tree (DT): Train the decision tree classifier directly on the provided network traffic features.
5. XGBoost (XGBoost): Train the XGBoost classifier directly on the provided network traffic features.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Type** & **Pcap Files** & **Flows** & **IP-Pairs** & **Edges** \\ \hline White & 5000 & 27,825 & 7032 & 706,243 \\ Black & 5000 & 90,584 & 9622 & 1,003,517 \\ Total & 10,000 & 118,409 & 16,654 & 1,709,760 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Dataset Summary.  
* GTN [25] + X: Utilize the GTN deep learning model to derive new feature representations from the base features, then apply various classifiers (LR, NB, KNN, DT, XGBoost) to these representations.
* GCN-ETA [26] + X: Employ the GCN-ETA deep learning model to generate new feature representations from the base features, followed by training various classifiers (LR, NB, KNN, DT, XGBoost) on these representations.
* AFF_CGE + X: Use the AFF_CGE deep learning model to produce new feature representations from the base features, then train various classifiers (LR, NB, KNN, DT, XGBoost) on these enhanced representations. Evaluation Metrics: This paper evaluates the proposed AFF_CGE method using Precision (PRE), Recall (REC), and F1-score (F1) metrics. Here, TPs, FPs, and FNs represent True Positives, False Positives, and False Negatives, respectively. In this study, black samples (malicious traffic) are classified as positive instances, while white samples (benign traffic) are classified as negative instances.
* Precision (PRE) measures the accuracy of the model in identifying positive instances, i.e., the proportion of correctly predicted positive samples out of all predicted positive samples. It is calculated using the following formula: \[PRE=\frac{TP}{TP+FP}\] (15)
* Recall (REC) measures the model's ability to correctly identify positive instances, i.e., the proportion of correctly identified positive samples out of all actual positive samples. It is calculated using the following formula: \[REC=\frac{TP}{TP+FN}\] (16)
* F1-Score (F1): Taking the harmonic mean of Precision and Recall into consideration, the calculation formula is as follows: \[F1=\frac{2*PRE*REC}{PRE+REC}\] (17)