## 5 Experimental Results
### Ablation Study and Analysis  
To better elucidate the contributions of individual components within the AFF_CGE framework, we perform an ablation study. This study systematically removes key components, specifically Attention-aware Feature Fusion (AFF) and Communication Graph Embedding (CGE), to assess their impact on performance. The results of this ablation study will underscore the necessity and effectiveness of each module, illustrating how these components interact to improve the detection of encrypted malicious traffic. The ablation study is organized into four experimental configurations:  
* AFF_CGE + X: This combines the AFF and CGE modules to learn feature representations from base features, performing both feature fusion and communication relationship learning, and then trains using various classifiers X (e.g., LR, NB, KNN, DT, XGBoost). * (-AFF) + X: This model is derived by removing the AFF module, using only the CGE module to learn communication relationships from base features, followed by training with various classifiers X. * (-CGE) + X: This model is derived by removing the CGE module, using only the AFF module for feature fusion based on base features, followed by training with various classifiers X. * (-AFF-CGE) + X: This model serves as the baseline, excluding both the AFF and CGE modules. It utilizes various classifiers X to train on the base features. To ensure the fairness and objectivity of the comparison, we employed five-fold cross-validation. This technique mitigates random errors by repeatedly training and testing the model under the same conditions, and computes the average of each performance indicator to provide a robust final result. Table 3 presents the performance metrics (Precision, Recall, F1-score) for each classifier across different configurations. Figure 6 shows the comparison results. The comparative analysis reveals the following insights:  
1. [label=()]
2. AFF_CGE + X: The combination of both AFF and CGE modules (AFF_CGE + X) achieves the highest performance. As illustrated in Figure 6, incorporating both modules results in improvements across nearly all metrics compared to using either AFF or CGE alone. This finding highlights the complementary nature of AFF and CGE in feature fusion and communication relationship learning, leading to a more effective model for identifying encrypted malicious traffic. 3. (-AFF) + X: The model with the AFF module removed also brings significant performance improvements, with average improvements ranging from 2.3% to 22.4%. In addition, the CGE module surpasses AFF in terms of overall performance improvement, indicating its ability to skillfully capture the complex interactive relationships between traffic entities. This feature is critical for detecting abnormal communication patterns in encrypted malicious traffic. 4. (-CGE) + X: Compared with the baseline model (-AFF-CGE), the addition of the AFF module significantly improves the performance of all classifiers, with the F1-score increasing by about 2.2% to 18.7%. This improvement highlights the effectiveness of the AFF module in integrating the internal features of encrypted malicious traffic through the attention mechanism, thereby enhancing the model's ability to capture complex features. In summary, the integration of AFF and CGE modules provides a comprehensive enhancement in model performance, demonstrating their combined efficacy in addressing the challenges of encrypted malicious traffic detection.