## 1 Introduction  
With the rapid development of Internet technology, the scale of network traffic is growing rapidly, especially the frequent transmission of sensitive information such as login credentials and personal data in the network, which makes network security a key problem that needs to be solved urgently. To ensure the privacy and security of data transmission, encryption technologies like SSL/TLS protocols have been widely adopted across various network services [1]. According to the Google Transparency Report, over 95% of web services now use encryption protocols [2]. However, while encryption enhances data security, it also introduces unprecedented challenges for network traffic analysis, particularly in detecting malicious traffic. Malicious attackers can exploit encryption to conceal their malicious actions, such as transmitting malware through encrypted traffic. The widespread use of end-to-end encryption technologies [3] has further complicated traffic analysis, as it prevents third parties from directly analyzing the content of network traffic. This not only creates obstacles for Internet Service Providers (ISPs) in tasks like monitoring video transmission quality but also significantly increases the complexity and difficulty of network defense. Therefore, developing efficient and accurate methods for detecting encrypted malicious traffic has become a research hotspot and a pressing need in the field of cybersecurity. Although many studies have attempted to analyze the statistical and side-channel features of encrypted traffic using machine learning and deep learning techniques to classify traffic without accessing its encrypted content, most of these methods are limited by their focus on single-feature analysis. This narrow approach fails to account for the deep semantic information within the traffic and the complex structural relationships between traffic flows. As a result, these methods struggle to comprehensively capture and represent the key features of increasingly sophisticated encrypted malicious traffic. To address the aforementioned challenges, this paper proposes an innovative method for feature representation learning of encrypted malicious traffic--AFF_CGE (Attention-aware Feature Fusion and Communication Graph Embedding Learning). This method cleverly combines the attention mechanism from deep learning with graph neural network technology. Through the Attention-aware Feature Fusion (AFF) mechanism, it deeply explores the internal features of encrypted traffic, while the Communication Graph Embedding Learning (CGE) technique effectively captures the structural relationships between traffic flows, achieving a multi-level and multi-dimensional representation of encrypted traffic features. Experimental results demonstrate that the AFF_CGE method exhibits significant superiority and stability in detecting encrypted malicious traffic. Compared to traditional handcrafted feature extraction methods, AFF_CGE improves the F1-score of the feature representation learned from basic session features by 5.3 to 22.8 percentage points, validating its strong feature extraction capability. More importantly, the feature representations learned by AFF_CGE achieve F1-scores between 0.903 and 0.929 across various classifiers, including logistic regression, Naive Bayes, K-nearest neighbors, decision trees, and XGB-Boost, showing more stable and superior performance compared to current state-of-the-art methods (i.e., GTN, GCN-ETA). This robust performance fully demonstrates the effectiveness and reliability of AFF_CGE in detecting encrypted malicious traffic. The main contributions of this paper are summarized as follows:  
* Leveraging Base Feature Fusion with the AFF method:This study reveals a critical finding: integrating base features can substantially enhance the performance of malicious traffic detection models. Building on this insight, we introduce the Attention-aware Feature Fusion (AFF) module.