# Fine-Grained High-Utility Dynamic Fingerprinting Extraction for Network Traffic Analysis
## 3 Data Processing
### Network Traffic Segment  
Packets constitute the data in the network, and each packet has a fixed attribute. Figure 5 shows a segment of network traffic captured in the actual QQ communication process, which also contains some data packets from other applications. In the actual process of obtaining traffic, the traffic packets sent and received by the terminal must be a mixture of multiple applications, which makes it possible to divide traffic based on IP address transition (IAT). The network traffic obtained here contains a large number of encrypted packets, which can be directly obtained by processing only six limited attributes: time, source, destination, protocol, length, and info. Here, to define any packets the following is used: \(p_{i}=[t,\,II_{src},\,IP_{dst},\,prt,\,l,\,Info]\). Based on the data packet attributes that can be directly obtained, this section analyzes the sequence of data packets to obtain encrypted traffic fingerprints. Data packets generated when multiple applications installed on a terminal exchange data with the server are sent sequentially. Within a time interval \(T=[t_{start},t_{end}]\), define the data flow \(T_{f}=(p_{1},p_{2},\cdots,p_{N})\) generated (\(N\) is the number of packets obtained). Any packet contains six attributes: \(p_{i}=[t,\,II_{src},\,IP_{dst},\,prt,\,Info]\). The object to be dealt with is the data flow defined above. Given a data flow \(T_{f}\) of mixed data from multiple applications, the proposed method should accomplish two tasks:  
* Process the data stream \(T_{f}\) and divide the packet sequence \(\mathit{seq}_{T}=\left\{p_{1},p_{2},\cdots,p_{N}\right\}\) into several small data stream segments according to the relevant attributes and message analysis: \[\mathrm{S}_{\mathrm{T}_{f}}=\left\{\left\langle\mathrm{P}_{1},\mathrm{P}_{2}, \cdots,\mathrm{P}_{1}\right\rangle,\left\langle\mathrm{P}_{i+1},\mathrm{P}_{ i+2},\cdots,\mathrm{P}_{\mathrm{j}}\right\rangle,\cdots,\left\langle\mathrm{P}_{ \mathrm{j+1}},\mathrm{P}_{\mathrm{j+2}},\cdots,\mathrm{P}_{\mathrm{N}} \right\rangle\right\}\]
* Based on data stream fragments, the dynamic extraction of fine-grained fingerprint features is realized through the method. The specific method is described in Section 3. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Network Layer** & **Protocol** & **Notation** \\ \hline \multirow{3}{*}{Application layer (30:)} & HTTP & 31: \\ \cline{2-3}  & POP & 32: \\ \cline{2-3}  & IMAP & 33: \\ \hline \multirow{3}{*}{TLS/SSL (20:)} & Change Cipher Spec Protocol & 21: \\ \cline{2-3}  & Alert Protocol & 22: \\ \cline{2-3}  & Handshake Protocol & 23: \\ \cline{2-3}  & Application Data Protocol & 24: \\ \hline \multirow{3}{*}{Transport layer (10:)} & \multirow{3}{*}{TCP(11:)} & (SYN) & 11:01 \\ \cline{3-3}  & & (ACK) & 11:02 \\ \cline{3-3}  & & (SYN, ACK) & 11:03 \\ \cline{3-3}  & & (FIN, ACK) & 11:04 \\ \cline{3-3}  & & (PSH, ACK) & 11:05 \\ \cline{3-3}  & & (RST, ACK) & 11:06 \\ \hline \multicolumn{2}{c}{UDP} & 12: \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Protocols’notation. This paper proposes a new method for the division of data flow \(T_{f}\), which is no longer based on the simple time interval but on the six basic attributes of packets to find the \"breakpoint\" of network traffic, to achieve the purpose of accurate division of network traffic. In the process of sending and receiving data packets, network devices complete an \"action\" in a time interval, similar to that in an operating system. The CPU is divided into several time slices, and each time slice processes one process. This \"action\" is equivalent to the application fingerprint that can be extracted. Therefore, in dividing data flows, the determination of \"breakpoints\" is based on this feature of network devices processing data. The \"breakpoint\" is determined according to the partitioning performance of each attribute of network traffic, that is, the optimal partitioning attribute.