# Fine-Grained High-Utility Dynamic Fingerprinting Extraction for Network Traffic Analysis
## 5 Experimental Analysis
### High-Utility Fingerprinting Extraction Experiment  
This experiment mainly analyzes the application of fingerprinting extraction based on utility. Firstly, the utility of different message types in different datasets is analyzed, and the influence of data stream size and class on the evaluation of message utility is analyzed. Then, the high-utility application fingerprint extracted by the Huf algorithm is be analyzed. In this paper, the tf-idf algorithm is used to evaluate the utility of the application. Figure 17 shows tf-idf values of the main types of packets under different datasets.  
Figure 17 shows that the category and number of packets have a great influence on the utility of packets. When the number of packets obtained is large enough, the packets tend to be stable. This is similar to natural language processing, which requires a large amount of text to form a huge corpus to ensure the accuracy of the calculation.  
The following is the analysis of the Huf algorithm to automatically obtain the effect of application fingerprinting. The Huf algorithm aims can take the place of manual analysis based on the application fingerprints of the session from the network traffic. First of all, obtaining the fingerprint must be accurate, and the requirement is to obtain as much as possible the application fingerprints that contain artificial analysis results. The second step is to reserve a small number of application fingerprints. Compared with TCP and UDP, encrypted messages account for only a small number of network data flows, because they are the part where the client establishes a connection with the server, and the server will maintain the connection for a long time in the future. Therefore, another criterion for  
Figure 16: FP_DS comparison.  
evaluating the Huf algorithm is the retention of these important few application fingerprints. Finally, the last step is to obtain the application of the fingerprint in the manual analysis that does not include the sample. The error extract fingerprint should be as far away as possible; otherwise, it will cause a certain influence on future traffic classification. This paper used the three standard evaluations of the above three kinds of situations. One first needs to access the application of fingerprint artificial analysis, which can be divided into two parts: \(FP_{e}\) that contains the encrypted message and \(FP_{u}\) that does not contain the encrypted message. The evaluation index is shown in (27).  
\[Metric_{Huf}=\frac{FP_{Huf}^{c}}{FP_{e}+FP_{n}}\times\frac{FP_{Huf}^{e}}{FP_{e }}\times\frac{FP_{Huf}}{FP_{Huf}-FP_{Huf}^{e}} \tag{27}\]  
\(FP_{Huf}\), \(FP_{Huf}^{c}\), and \(FP_{Huf}^{e}\) are the total number of application fingerprints, the number of correct classifications, and the number of encrypted messages obtained according to the Huf algorithm, respectively. The higher the value of \(Metric_{Huf}\) is, the better the effect of the Huf algorithm is. The experiment is conducted on the above dataset, and the results are shown in Figure 18.  
Figure 17: Utility of Messages.  
Figure 18: Metric\({}_{\text{Huf}}\) Comparison.  
It can be seen from Figure 18 that when the Dataset1-Dataset5 obtained in the experiment have few data packets or the application is a single category, \(Metric_{\text{Huf}}\) is unstable and irregular. When the data packets collected are large and the time is long, \(Metric_{\text{Huf}}\) will be stable within a certain range.