# Fine-Grained High-Utility Dynamic Fingerprinting Extraction for Network Traffic Analysis
## 5 Experimental Analysis
### Fingerprinting Integrity Experiment  
Network packets are mostly encrypted data. Due to the huge amount of data, manual marking can only be used as part of the work, mainly through the text clustering of DNS messages to achieve data marking. In the experiment, an application is continuously used to compare with existing DNS messages to determine the type of data. Figure 14 shows the data packets when WeChat started. This part of the experiment is to verify the accuracy of fingerprinting extraction, mainly to analyze the comparison between the divided data stream fragment and the standard application fingerprint. The experiment needs to be manually marked first because the amount of data is huge, and the marking cannot be completely accurate. Therefore, through the observation and analysis of the above dataset many times, typical application fingerprints of various application categories are analyzed. Table 12 lists the partial fingerprints of various applications with the highest frequency. Table 12 shows some application fingerprints obtained by manual analysis. For example, the application fingerprints shown in lines 13-18 show the data packets captured by users using video applications. The network device has a limit on the size of data packets when sending data, and if the size exceeds the limit, they are divided into several packets and sent in sequence. A video will be divided into different types of packets, TCP or UDP, by network devices. This puts forward two evaluation criteria to analyze the address below division after obtaining the effect of the segments of data flow. The first standard is a fragment in the application fingerprints in artificial analysis to obtain the proportion. In the evaluation criteria as shown in (25), the analysis of the evaluation standard is divided into good segments of data flow and the relationship between the real application fingerprinting. \[DS\_FP=\frac{DS\cap FP_{s}}{FP_{s}} \tag{25}\]  
\(DS\) refers to the number of data flow fragments after the repetition is removed, and _FP_ refers to the number of application fingerprints obtained by manual analysis. Figure 15 shows the division of data flows in each dataset. Figure 14: The packets of Wechat. It can be seen from the analysis in Figure 15 that when the number of packets is small or the application type is single, the segmented data flow fragment type is small. When the dataset is mixed data, the more traffic that is captured, the closer the fingerprint obtained by manual analysis is. The next step is to analyze the part of the grab fragment that does not overlap with the application fingerprint, and (26) is used as the evaluation criterion:  
\[FP\_DS=\frac{\sum\limits_{i}FP_{i}}{DS} \tag{26}\]  
\(\sum\limits_{i}FP_{i}\) is the proportion of various application fingerprints in the divided data segments. This evaluation index analyzes the situation of data flow segments that are different from application fingerprints in the traffic. This paper defines such data flow segments that are not application fingerprints as \"fragments\" of the data stream, aiming to find out the reasons for sending these irregular packets. The analysis of these packet fragments that do not belong to the fingerprint can be of great help to the preprocessing of the data stream \begin{table}
\begin{tabular}{c c} \hline \hline
**Number** & **Fingerprinting** \\ \hline  
12:)_{n}(11:02)_{n}\) \\
18. & \(23:10,21:23:12,(11:02)_{n}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 12: Fingerprinting type. Figure 15: DS_FP comparison. and can remove a lot of interference and noise. Figure 16 shows the \"fragments\" of the data stream after the traffic division of each data set. As shown in Figure 16, a relatively high FP_DS scenario is using a single category of network traffic. In this case, network devices send data packets of the same application in a centralized manner, and data packets are retransmitted and rarely out of order. The reason why TCP data packets are retransmitted is that TCP data packets are retransmitted.