# GPON PLOAMd Message Analysis Using Supervised Neural Networks
## 5 Conclusions  
This paper evaluates various types of recurrent layers used for GPON protocol analysis. The learning data are captured in a fully functional GPON using a special FPGA card. The card captures whole frames, but analysis focuses only on PLOAMd messages; therefore, useless data are removed during the pre-processing phase. Almost all filtered data consist of messages with ID 11, which must be removed from the learning dataset. Otherwise, it causes false positive results. The remaining data are formatted into sequences of thirty messages using a sliding window, creating a learning dataset. Created sequences are used to evaluate the analysis performance of SimpleRNN-, LSTM-, and GRU-based models. The model comparison is based on validation dataset accuracy to reveal the pattern learning potential of each layer type.  
SimpleRNN is insufficient for such analysis due to it simply memorizing data instead of learning generalized principles. A single state vector without gating mechanisms in RNN design makes this layer not suitable for such analysis. The model with LSTM cells has almost the best accuracy for the learning and validation datasets; however, it consumes the most resources among all inspected models (the highest number of learned parameters). The GRU-based model has the best results in validation dataset classification compared to SimpleRNN. The GRU cell contains gating mechanisms as well, but the number of gates is lower compared to the LSTM cell. Even with fewer gates, GRU is able to learn complex data patterns specific to protocol analysis.  
Among all inspected models, only the model based on GRU cells is suitable for network protocol analysis. The investigated data contains complex relations and the GRU-based model is capable to learn these relations using its sophisticated gating mechanism. Considering the standard deviation, performance comparison results correlate with the similar comparisons in [47, 48, 49]. Therefore, GRU layer is recommended for protocol analysis, even if it has more learning parameters and takes more time to learn.  
Future Work OpportunitiesThis paper is focused strictly on three types of recurrent cells with supervised learning, but ML offers much more. There are some possibilities for further research on protocol analysis using neural networks:  
* **Convolutional network:** One possible enhancement is replacing the recurrent layer with a sequence of convolutional and max-pooling layers, which should reduce the complexity of the final neural network and speed up the learning and evaluating process.
* **Unsupervised learning techniques:** Another possible continuation of this work is to create a machine learning model and train it using unsupervised learning techniques. The problem with the supervised algorithms used in this paper is that the model needs samples of non-standard or corrupted communication, but these samples may not exist during the model learning process. The result of this project would be an anomaly detector capable of marking suspicious or non-standard communication sequences.  
Conceptualization, A.T., M.H., V.O., T.H., and P.M.; methodology, A.T., M.H., and V.O.; software, A.T.; validation, A.T., M.H., and V.O.; formal analysis, T.H. and P.M.; investigation, A.T., M.H., and V.O.; resources, V.O., T.H., and P.M.; data curation, A.T.; writing--original draft preparation, A.T., M.H., V.O., T.H., and P.M.; and visualization, T.H. and P.M.; supervision, M.H. and V.O. All authors have read and agreed to the published version of the manuscript.  
The research described in this paper was financed by a grant from the Ministry of the Interior of the Czech Republic, Program of Security Research, VI20192022135, PID VI3 VS/746 for \"Deep hardware detection of network traffic of next generation passive optical network in critical infrastructures\".  
The authors declare no conflict of interest.