# Unknown Traffic Recognition Based on Multi-Feature Fusion and Incremental Learning
## 2 Related Work
### Unknown Internet Traffic Identification  
To address the challenges posed by the closed-set assumption described above, researchers have combined the encrypted traffic classification problem with open-set recognition to detect unknown encrypted traffic. There are currently several main ideas to solve the unknown traffic identification problem: supervised, unsupervised, and semisupervised learning methods. Traditional supervised neural networks are unable to directly handle unknown traffic categories due to limitations in their model structure and training methods, which restrict their generalization ability. The classifier's fixed number of categories makes it impossible to reserve input space for unknown categories. During testing, when unknown samples appear, the SoftMax layer of the model assigns a high probability to the closest known training class, resulting in the unknown sample being classified to the nearest known category. Some researchers [29] attempted to add an unknown category node in the SoftMax layer, but this requires providing some unknown samples as negative examples during training. Doing so may affect the model's classification performance on known categories, and it cannot cover all possible unknown samples. Some researchers have proposed identifying unknown traffic by improving the output layer of the neural network, mainly based on confidence or backpropagation gradients. For example, [PERSON] et al. [30] proposed a network intrusion detection method based on open-set identification and investigated how extreme value theory (EVT) can be applied to unknown attack detection systems. The method establishes an Open-CNN model through introducing an OpenMax layer instead of the traditional SoftMax layer, which fits the postidentification activation of known classes to a Weibull distribution. Then, the pseudo-probability of unknown classes can be estimated from the activation scores of known classes by recalculating the activation in the penultimate layer, enabling the detection of unknown attacks. Ref. [31] also used the Open-CNN model. Meta-recognition theory was used to recalculate the activation vectors of the second-to-last layer, thus estimating the probability of unknown categories. In addition, active learning methods were combined, and a minimum confidence query strategy was used to select a subset of detected unknown attack samples for labeling and retraining. This method improves the ability to identify unknown attacks by more than 9% compared with the previous method. [PERSON] et al. [32] proposed a gradient-based additive angular margin loss (ArcFace) model, GMAF, which uses the first backpropagation of the ArcFace loss layer weight gradient to distinguish known from unknown traffic. In addition, the additive angular margin was added to the category balance focal loss, which improved the separability of categories. Ref. [33] integrated random forest, Adaboost, gradient boost, and XGBoost to build an ensemble classification framework Cor-ENTC to classify VPN traffic entering the SDN environment. The scheme is highly efficient in communication, significantly more accurate than a single classifier, and can also handle unknown applications. Although these improved methods can identify unknown traffic to a certain extent, they all ignore the key part of unknown traffic during training, which, to some extent, reduces performance, and the overall accuracy is poor in the mixed detection of known and unknown traffic. In addition to this, existing methods have a drawback in that most of the proposals are burdened with unnecessary difficulty in algorithm design to synchronize the classification of known traffic and the recognition of unknown traffic. In reality, we already have many well-performing network traffic classification methods. Therefore, separating the classification task from the recognition task would be an improvement. The existing classifiers can be used to separate known traffic from unknown traffic, focusing on the classification of known traffic to improve classification accuracy.