# Application Layer Protocol Identification Method Based on ResNet
## 4 Experimental Results and Discussion
### Datasets
#### 4.1.2 Shodan Dataset  
Shodan is a search engine designed to search and identify internet-connected devices and systems. Unlike traditional search engines like Google, it does not search web page content; instead, it searches devices across the entire internet, such as servers, routers, cameras, IoT devices, etc. Users can use various filters and keywords to precisely search for specific types of devices or obtain specific information. The search results typically include public information about devices, such as IP addresses, open ports, protocol types, etc.  
We developed a Python program using Shodan's open API to search for application layer protocol names on Shodan and save the results locally. Leveraging the list of assigned port numbers maintained by IANA, application layer protocol names were filtered and deduplicated, resulting in a set of 2204 application layer protocol names. The protocols were categorized based on the volume of data for each protocol, as shown in Figure 6b. Among these, there are 463 protocols with data volumes exceeding 1000 samples each, with 1200 samples captured for each protocol, totaling 555,600 samples.  
The CIC-IDS2017 dataset is based on real network interaction packet capture data, while the Shodan dataset consists of packet capture data from network scanning processes. By processing and training on these two mixed datasets, the proposed method in this paper can effectively reflect its performance in both real-world and specialized environments.  
The data for the three protocols obtained from the dataset are shown in Table 1. From the table, we can see that the BGP protocol contains distinct characteristic data blocks, such as \"BGP\", \"Messages\", \"ASN\", and other feature identifiers. Similarly, the HTTP header also contains numerous characteristic data blocks, such as \"HTTP\" \"200\" \"OK\". For the SMB protocol, which consists of both character and binary data, it is easy to visually identify characteristic data blocks like \"MAILSLOT\", \"BROWSE\", and Samba. However, there are also some garbled data that cannot be directly attributed to specific attributes.  
\begin{table}
\begin{tabular}{l l l} \hline \hline \multicolumn{1}{c}{**BGP**} & \multicolumn{1}{c}{**SMB**} & \multicolumn{1}{c}{**HTTP**} \\ \hline  & & HTTP/1.1 200 OK \\  & & Cache-Control: no-cache \\  & & Pragma: no-cache \\  & & Content-Length: 113 \\  & & Content-Type: text/html; charset = utf-8 \\  & & Equires: Thu, 06 Jul 2017 12:00:18 GMT \\  & & Server: Microsoft-IDS/8.5 \\  & & P3P: CP = “DSP CUR OTP! IND OTRi ONL. FIN\" \\  & & X-Content:Type-Options: nosniff \\  & & X-Content:Type-Options: nosniff \\  & & Strict-Transparent-Security: max-age = 31536000 \\  & & X-XSS-Protection: 1; mode = block \\  & & CIC – WEBSEVER \# UBit: \\  & & & Date: Thu, 06 Jul 2017 12:01:18 GMT \\  & & Connect: close \\  & & \\  & & \\  & & \\  & & \\ \end{tabular}
\end{table}
Table 1: Table displaying the BGP, SMB, and HTTP protocols from the dataset.  
Figure 6: This image mainly displays the dataset used in this paper’s experiments and the data distribution ratios, where (**a**) represents the CIC-IDS2017 dataset and (**b**) represents the Shodan dataset.