## 5 Experiment Evaluation
### Comparison of Different Machine Methods on Tor-Snowflake HS Identification  
We use the same five machine learning algorithms to partition the training set from our own Tor-Snowflake dataset to train models and check the validity using a ten-fold cross-validation method. We select the first 300 messages of the DTLS data transmission and construct the dataset by sampling 40 sample points for the accumulative message payload length. We construct the experiment results in the form of a confusion matrix for calculating the accuracy rate, precision rate, recall rate, and F1-score. The recognition performance of the five models is shown in Table 5.  
\begin{table}
\begin{tabular}{c c c c c} \hline  & **n = 50** & **n = 100** & **n = 200** & **n = 300** & **n = 350** \\ \hline m = 20 & 0.5425/1.27 & 0.5826/1.22 & 0.8791/1.03 & 0.9807/0.84 & 0.9806/0.79 \\ m = 40 & 0.5301/1.56 & 0.5721/1.46 & 0.8844/1.27 & 0.9812/1.04 & 0.9796/0.98 \\ m = 60 & NULL & 0.5772/1.70 & 0.8771/1.43 & 0.9813/1.23 & 0.9795/1.14 \\ m = 80 & NULL & 0.5913/1.92 & 0.8763/1.62 & 0.9796/1.42 & 0.9801/1.30 \\ m = 100 & NULL & 0.5927/2.12 & 0.8750/1.81 & 0.9801/1.58 & 0.9813/1.45 \\ m = 120 & NULL & NULL & 0.8783/2.01 & 0.9796/1.76 & 0.9796/1.59 \\ m = 140 & NULL & NULL & 0.8761/2.20 & 0.9795/1.92 & 0.9796/1.76 \\ m = 160 & NULL & NULL & 0.8778/2.37 & 0.9790/2.09 & 0.9807/1.92 \\ m = 180 & NULL & NULL & 0.8764/2.56 & 0.9796/2.26 & 0.9807/2.09 \\ m = 200 & NULL & NULL & 0.8757/2.55 & 0.9806/2.30 & 0.9801/2.09 \\ \hline \end{tabular}
\end{table}
Table 4: Experimental results for the optimal combination of parameters (n, m).  
\begin{table}
\begin{tabular}{c c c c c c} \hline
**Classifier** & **Accuracy** & **Precision** & **Recall** & **F1** & **Time** \\ \hline Random Forest & 0.9917 & 0.9860 & 0.9825 & 0.9871 & 1.0498 \\ K-Neighbors & 0.9903 & 0.9856 & 0.9831 & 0.9867 & 0.0126 \\ XGBost & 0.9897 & 0.9848 & 0.9820 & 0.9859 & 0.3623 \\ AdaBoost & 0.9858 & 0.9824 & 0.9815 & 0.9836 & 0.9731 \\ SVM-Linear K & 0.9763 & 0.9551 & 0.9406 & 0.9559 & 0.2953 \\ \hline \end{tabular}
\end{table}
Table 5: Recognition performance of five models.  
As seen from the table, our proposed method ACCUMUL achieves an accuracy of over 99% in identifying HS traffic under the Tor-Snowflake scenario when building models using RF and KNN. The result indicates that models constructed by extracting features through ACCUMUL method can effectively identify Tor-Snowflake HS access activities in the network. Among them, the Random Forest algorithm shows better results in most evaluation metrics. The KNN algorithm is close to the results of RF, but its model training time consumption is less. When using the ACCUMUL method to extract features to identify HS access activities, the KNN algorithm would be a better choice, which can improve the overall identification speed of the Tor-Snowflake traffic. The XGBoost and AdaBoost algorithms also have a good performance in the results, but the linear classifier SVM has a relatively poor performance. To summarize the above, the nonlinear classifier has a good performance in identifying Tor-Snowflake HS access activities, and it is more appropriate to choose KNN for model training of the framework for HS traffic identification.