# Application Layer Protocol Identification Method Based on ResNet
## 4 Experimental Results and Discussion
### Experimental Results and Analysis
#### 4.4.4 Test Results  
Testing was conducted using the optimal model parameters obtained during training. As shown in Table 6, it is evident that the method of using composite RGB images significantly outperforms the \"origin\" group method in all metrics. According to the data in the table, we can conclude that using our proposed method, when the hyperparameters are the same, the accuracy, precision, recall, and F1 score of protocol recognition for all three models improved by more than 2%, reaching over 98%.  
The data in the table show that using the composite RGB image method significantly outperforms the origin group method in all metrics, with group A consistently achieving the highest scores. According to the data in the table, it can be concluded that using our proposed method, with the same hyperparameters, the accuracy, precision, recall, and F1 score for protocol recognition of all three models improved by more than 2%, reaching over 98%.  
We selected the confusion matrix generated from the \"our\" group when tested on the ResNet50 model, as shown in Figure 9. From the data in the figure, it can be inferred that the primary factor affecting recognition accuracy currently is that some labels of HTTP protocol (label 5) are being identified as TLS (label 19).  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multirow{2}{*}{**Indicator**} & \multicolumn{5}{c}{**Category**} \\ \cline{3-7}  & & **Origin** & **A** & **B** & **C** & **Our** \\ \hline \multirow{4}{*}{ResNet18} & Accuracy & 0.95775 & **0.988** & 0.9875 & 0.987 & 0.98325 \\  & Precision & 0.961408 & **0.989129** & 0.988522 & 0.988129 & 0.98377 \\  & Recall & 0.95775 & **0.988** & 0.9875 & 0.987 & 0.98325 \\  & F1 & 0.954432 & **0.988061** & 0.987562 & 0.98707 & 0.983358 \\  & Accuracy & 0.95775 & **0.98925** & 0.9875 & 0.98525 & 0.98875 \\  & Precision & 0.960454 & **0.990462** & 0.98699 & 0.985907 & 0.98778 \\  & Recall & 0.95775 & **0.98925** & 0.9875 & 0.98525 & 0.98875 \\  & F1 & 0.954994 & **0.989333** & 0.987546 & 0.985228 & 0.988799 \\  & Accuracy & 0.96225 & **0.98875** & 0.987 & 0.988 & 0.9875 \\  & Precision & 0.968945 & **0.989618** & 0.987622 & 0.989147 & 0.98897 \\  & Recall & 0.96225 & **0.98875** & 0.987 & 0.988 & 0.9875 \\  & F1 & 0.959011 & **0.988839** & 0.986982 & 0.988029 & 0.987634 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Comparison of test results.  
To address this issue, we sampled the dataset and observed the feature data blocks for HTTP and TLS protocols obtained from different sets of separators. Table 7 compares the feature data blocks.  
From the data in the table, it can be observed that the TLS feature data blocks are not prominent, with the highest frequency being only 165 occurrences. The confusion matrix shows a recognition accuracy of 100% for the TLS protocol. Therefore, we conclude that some HTTP data packets are relatively long and are split into multiple packets for transmission. Only the first packet contains the HTTP header information, while the subsequent packets contain only data. These data packets, lacking header information, resemble TLS packets. The model may misclassify these packets as TLS, when they are in fact HTTP packets.