# Unknown Traffic Recognition Based on Multi-Feature Fusion and Incremental Learning
## 2 Related Work
### Known Internet Traffic Identification  
As we already stated in Section 1, the traditional port-based and packet-payload-based traffic detection methods are not suitable for encrypted traffic classification because of simple matching rules. Current research on encrypted traffic has mainly focused on the deep learning field. Network structures such as convolutional neural networks (CNNs), with outstanding performance in image classification; recurrent neural networks (RNNs), suitable for natural language processing; and knowledge graphs, with excellent visualization performance, have been applied in the field of traffic processing.  
Ref. [21] first presented the application of an end-to-end method in the field of encrypted traffic classification. The method utilizes a one-dimensional convolutional neural network (1D-CNN) to extract and select traffic features, integrating feature extraction, feature selection, and classifier into a unified end-to-end framework. The paper demonstrated that 1D-CNN is more suitable for encrypted traffic classification tasks than 2D-CNN as network traffic is essentially one-dimensional and continuous data streams, taking full advantage of the strengths of 1D-CNN.  
Tree-RNN [22] integrates multiple end-to-end small classifiers to form a large tree-form classifier. The individual small classifiers complement each other in terms of performance, overcoming the problem where a single classifier is less accurate in some categories. Tree networks can automatically learn the nonlinear relationships between input and output data without extracting features.  
CNNs and RNNs can also be used in combination. App-Net, proposed in [23], learns a joint flow-app embedding by feeding TLS traffic into a 1D-CNN and a bi-LSTM in parallel to describe traffic sequence patterns and unique application signatures. The method achieved 96.41% accuracy and a 91.89% macro-F1 score on a real-world dataset covering 65 applications.  
Since both CNN and RNN learning and training depend on labels, semisupervised or unsupervised learning methods have been proposed to cope with poorly labeled or unlabeled data. For example, ByteSGAN [24] only needs to use a small amount of tagged traffic to achieve the goal of traffic classification in a fine-grained manner. MT-FlowFormer [25] is an efficient classifier with an attention mechanism that extracts features from flow sequences at low computational cost and a mean-teacher-style semisupervised framework to exploit unlabeled flow data. [PERSON]. [26] applies an improved k-means algorithm to traffic classification, effectively overcoming the problem of clustering results depending on the value of k, and analyzes the impact factors of clusters. The clustering-based quadratic network (CQNet) proposed in [27] applies metric learning to the classification problem of encrypted traffic of decentralized applications (DApps), reducing the redundancy in the training dataset and thus improving the efficiency of the classifier. [PERSON]. [28] implemented an unsupervised anomaly detection method using a three-layer autoencoder that achieved an F1-measure of 95%, which was also competitive with supervised learning algorithms.  
The above methods provide effective solutions for encrypted traffic detection from different perspectives. However, considering the more complex network environment in the real world, the traffic classes to be identified are more abundant and various, and there are often unknown traffic types that do not exist in the training set. When testing traffic samples of unknown categories, the above methods might misclassify them into known categories, resulting in a high false positive rate, significantly affecting the accuracy of the classifier.