# A Self-Supervised Learning Model for Unknown Internet Traffic Identification Based on Surge Period
## 3 Methods
### The Surge Period-Based Feature Extraction Method in Unknown Internet Traffic Identification  
In this paper, we propose a novel surge period-based method of feature extraction for unknown Internet traffic identification. As we mentioned above, machine learning has strict requirements on the length and format of the input. Hence it is necessary to contain more Internet traffic features as input when identifying unknown Internet traffic. We all know that the communication of Internet protocols can be regarded as a combination of different network behaviors (such as user authentication, data request, and data upload). In other words, different network behaviors contain different characteristics of Internet protocols. Hence it is significant to obtain more network behaviors in the input of machine learning to acquire more Internet protocol features. The feature extraction method we propose follows the idea of the surge period, which was initially proposed by [PERSON] [25]. As the name implies, the surge period refers to the time interval of surging Internet traffic. It is defined by the surge time of Internet traffic density or bandwidth utilization and usually marks the traffic part where the network channel is busy uploading or downloading packets. Additionally, the time interval between any two adjacent data packets, except for the first one and the last one, should not be greater than the period of the predetermined time window size. Figure 2 outlines the flow diagrams of the surge period-based feature extraction method, as well as the traditional one without surge periods. The surge period-based feature extraction method identifies the background traffic through the instantaneous speed of network sessions. Moreover, each surge period refers to the beginning of new network behavior, which allows the algorithm to further extract the flow characteristics. In this way, it could eliminate the impact of background traffic and meanwhile contain rich network behaviors, which help to extract a large number of network traffic features for further identification. For example, if a surge period contains \(n\) kinds of behaviors, the amount of feature information of each network behavior \(x\) is calculated as Equation (1):  
\[info\{x\}=-\log P_{x}=\log\frac{1}{P_{x}} \tag{1}\]  
Figure 2: The flow diagram of the surge period-based feature extraction method and the traditional one without surge period considerations. Hence the total features \(info\{X\}\) included in each surge period can be calculated using Equation (2):  
\[info\{X\} \approx-\log\left(\prod_{i\in[0,\dots,n_{0}]}P(x_{i})\right) \tag{2}\] \[=-\sum_{i\in[0,\dots,n_{0}]}\log P(x_{i})\] \[=\sum_{i\in[0,\dots,n_{0}]}info\{x_{i}\}\]  
where \(n_{0}\) is the number of network behaviors in a surge period. Algorithm 1 introduces the surge period-based feature extraction method in detail. First, it reorganizes the Internet traffic according to a 5-tuple of network sessions and finds up-streams and down-streams of each network session. Meanwhile, it needs to detect the timestamp and size sequence of various data packets. Afterward, the method would calculate the speed of bit flow in each session with the period of \(t_{0}\) and regard these with a speed greater than \(v_{0}\) as a surge period. Following that, it extracts the packet length of the first \(n\) surge periods in chronological order and pads with zeros if there are not enough surge periods. Each surge period is characterized by the length of the first \(k\) packets, and similarly, pads with zeros if the data length of the surge period is insufficient. In the end, all data packets in all surge periods are traversed and extracted to generate the original features for subsequent pre-training and identification.