## 4 Method
### Attention-Aware Feature Fusion (AFF)  
The proposed AFF mechanism aims to extract and fuse key semantic features of encrypted traffic using a self-attention mechanism (SA). This approach enhances the representation learning of encrypted malicious traffic by combining critical semantic insights through residual connections and feed-forward neural networks, enabling cross-feature fusion at a deeper level. In the AFF framework, the self-attention mechanism is utilized to capture the semantic relationships between encrypted traffic features. SA dynamically assigns weights to each feature, ensuring that the most critical features for malicious traffic detection are emphasized during representation learning. For \(n\) samples, given an input feature matrix \(X=[x_{1},x_{2},\dots,x_{n}]^{T}\in\mathbb{R}^{n\times d_{x}}\), the matrix \(X\) is mapped to query (\(Q\)), key (\(K\)), and value (\(V\)) matrices through a linear transformation, as shown below:  
\[Q =XW^{Q} \tag{4}\] \[K =XW^{K}\] (5) \[V =XW^{V} \tag{6}\]  
The self-attention mechanism then calculates the attention scores and generates weighted feature representations using the following equation:  
\[SA(Q,K,V)=\text{SoftMax}\biggl{(}\frac{QK^{T}}{\sqrt{d}}\biggr{)}V \tag{7}\]  
where \(d\) represents the dimensionality of the key matrix \(K\). This formulation allows the model to focus on the most relevant features by assigning appropriate weights, thereby enhancing the effectiveness of malicious traffic detection. In this process, the input matrix \(X\) is multiplied by the parameter matrices \(W^{Q}\), \(W^{K}\), and \(W^{V}\), respectively, generating the corresponding \(Q\), \(K\), and \(V\) matrices. This operation can be seen as a linear transformation applied to the input data. The self-attention mechanism does not directly use the raw input \(X\); instead, it utilizes these generated \(Q\), \(K\), and \(V\) matrices to extract more meaningful features, enhancing the model's ability to understand and fit the data. This allows the model to dynamically adjust the importance of features, resulting in a more precise data representation. To further improve the model's feature extraction capability, we introduce the Multi-Head Self-Attention mechanism (\(MSA\)). \(MSA\) applies several attention heads in parallel, then concatenates their outputs and passes them through a linear transformation to integrate the information, as shown in the formula for \(MSA\):  
\[MSA=\text{Concat}(\text{head}_{1},\dots,\text{head}_{n})W^{O} \tag{8}\]  
where each attention head is defined as  
\[\text{head}_{i}=SA(QW_{i}^{O},KW_{i}^{K},VW_{i}^{V}) \tag{9}\]  
This approach enables the model to capture information across different dimensions of the data, thereby enriching and enhancing the accuracy of feature representations. The feature vectors processed by \(MSA\) are then passed through a feed-forward neural network for feature interaction and fusion. To alleviate the vanishing gradient problem during deep network training and to promote deeper feature integration, we introduce a residual connection. This residual connection adds the original input \(X\) to the output of \(MSA\), as shown in the formula for residual connection (\(RC\)):  
\[RC=MSA(X)+X \tag{10}\]  
The result is then passed through a ReLU activation function and another linear transformation to produce the final output feature matrix \(Z=[z_{1},z_{2},\dots,z_{n}]^{T}\in\mathbb{R}^{n\times d_{z}}\):  
\[Z=\text{ReLU}(RCW_{1}+b_{1})W_{2}+b_{2} \tag{11}\]  
where \(W_{1}\) and \(W_{2}\) represent weight matrices, \(b_{1}\) and \(b_{2}\) are bias vectors, and \(Z\) is the output feature matrix generated by the AFF mechanism. The AFF mechanism dynamically adjusts feature weights using the self-attention mechanism, allowing the model to adaptively identify key features based on the characteristics of each sample. This enhances the precision and relevance of feature representations.