# A Self-Supervised Learning Model for Unknown Internet Traffic Identification Based on Surge Period
## 4 Results and Discussions
### Experiment Performance  
We introduce the parameters of our workspace as follows: Intel(r) Xeon(r) Silver 4110 CPU @ 2.10 GHz, 64.0 GB RAM @ 2666 MHz, 480 GB SSD, and NVIDIA TITAN Xp. In our established model, the inputs are TCP/UDP sessions of different lengths. The data packets in each session are shaped in chronological order, and the surge period-based features are extracted to generate a visual gray image with a size of 20 \(\times\) 20. Partial feature images of network sessions are shown in Figure 5.  
After obtaining the original features of unknown Internet traffic based on surge periods, we train them with the JigClu-based feature pre-training model for 100 epochs and adopt NADAM as the optimizer of the pre-training model. We conduct multiple rounds of tests for parameter optimization with the method of the grid search, and the optimal parameter settings are shown in Table 2. \begin{table}
\begin{tabular}{l c c c} \hline \hline
**Class** & **Totalconv** & **Totalsurge** & **TotalP** \\ \hline aim\_chat & 419 & 459 & 4766 \\ email & 7518 & 4417 & 45,757 \\ facebook\_audio & 79,955 & 80,924 & 1,858,229 \\ facebook\_chat & 507 & 1851 & 10,882 \\ facebook\_video & 431 & 11,603 & 739,891 \\ ftps & 849 & 12,716 & 7,872,864 \\ gmailchat & 450 & 2134 & 12,240 \\ hangouts\_audio & 79,444 & 80,935 & 1,858,075 \\ hangouts\_chat & 436 & 1771 & 13,202 \\ hangouts\_video & 1533 & 19,612 & 1,990,642 \\ icq\_chat & 437 & 624 & 4119 \\ netflix & 380 & 2089 & 299,263 \\ sftp & 11,690 & 5543 & 1,700,514 \\ skype\_audio & 38,820 & 32,839 & 882,213 \\ skype\_chat & 8828 & 4253 & 70,183 \\ skype\_file & 57,317 & 12,401 & 1,365,641 \\ skype\_video & 599 & 16,261 & 1,520,980 \\ spotify & 301 & 918 & 41,180 \\ vimeo & 452 & 7299 & 146,375 \\ voipbuster & 2963 & 36,481 & 842,535 \\ youtube & 925 & 1330 & 252,071 \\ Total & 294,254 & 336,460 & 21,531,622 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The detailed information of the ISCXVPN2016. Figure 6 presents the changes in the loss function when training the JigClu-based feature pre-training model. In the training process, the loss function gradually reduces until the convergence speed slows down after 20 cycles and tends to converge after 50 cycles. It demonstrates the model with a relatively good training speed. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Parameter** & **Value** & **Meaning** \\ \hline temperature & 0.7 & Gain coefficient of superCluLoss \\ batch\_size & 128 & Number of samples in each batch \\ epochs & 200 & Training rounds \\ learning\_rate & 0.0001 & The learning rate \\ inputshape & (20,20) & Size of features extracted from the session \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The optimal parameter settings in our experiment. Figure 5: Partial images of surge periods-based original features extracted from network sessions. After the pre-training model has been established, we remove the data positioning and reorganization modules and connect the features learned from unknown Internet traffic with the following clustering methods. Here, we conduct the final classification with K-means by setting different k clusters under the three different scenarios. In order to evaluate the performance of our proposed method in identifying unknown Internet traffic, we adopt a confusion matrix to calculate the common indicators of precision (\(P\)), recall (\(R\)), and \(F_{1}\) score. In our experiment, we introduce the confusion matrix of true positive (\(TP\)), true negative (\(TN\)), false positive (\(FP\)), and false negative (\(FN\)). \(TP\) refers to assigning two identical protocol traffic data to the same cluster, while \(TN\) represents assigning two different protocols traffic data to different clusters. Additionally, \(FP\) means wrongly identifying traffic data of different protocols as the same cluster, and \(FN\) is to assign traffic data in identical protocols to different clusters.