# Unknown Traffic Recognition Based on Multi-Feature Fusion and Incremental Learning
## 2 Related Work
### Unknown Internet Traffic Identification
However, for unknown traffic, only preliminary extraction of unknown samples can be performed, without fine-grained classification. Further operations are required to classify the separated unknown traffic in more detail. Unknown encrypted traffic in the real world does not contain prior information such as labels. In this case, unsupervised learning methods are more applicable for detection. Ref. [34] used a lightweight structure with a two-layer architecture of random forest and SVM and a voting mechanism to achieve mixed-traffic classification including a large amount of unknown traffic with a low model update cost. Clustering algorithms are also commonly used to identify unknown Internet traffic. [PERSON] et al. [35] proposed an unsupervised unknown traffic identification framework based on n-gram embeddings, a deep autoencoder, and clustering algorithms. The n-gram embeddings strategy converts traffic data into high-dimensional vector representations, capturing both local and global features of traffic. The use of deep neural networks enhances the discriminative power of traffic. Additionally, the unsupervised classification of traffic vectors is achieved using algorithms such as k-means and spectral clustering, resulting in high clustering purity. [PERSON] et al. [36] proposed another unsupervised framework based on the MPCKMeansalgorithm, called DePCK, to improve the classification of mixed unknown traffic. This framework fully utilizes traffic correlations to guide the process of pairwise constrained clustering. Extracting and learning unknown features from unlabeled data is the main advantage of unsupervised methods for unknown traffic classification. However, mapping the extracted clusters to limited application types is a challenging task in the absence of prior information. Semisupervised clustering adds a portion of labeled data to the training process to solve the mapping problem of traffic clustering to application categories. For example, in ref. [37], the authors extracted features from encrypted packet headers and payloads using a CNN and an RNN and employed a self-organizing map (SOM) to cluster the extracted features into different classes. Another example of semisupervised learning method for unknown traffic detection was proposed by [38], which uses a variational autoencoder (VAE) to learn latent representations from encrypted packet data. A Gaussian mixture model (GMM) was used to cluster the latent representations into different components based on their probability distribution. Additionally, they developed an open-source platform called OpenCBD that can identify and analyze unknown protocols in network flows. The model proposed in [39] also comes with a self-labeling process after clustering, which can provide accurate labels for packets of unknown categories, thus creating new datasets and supporting autonomous learning updates of the classifier. Ref. [40] proposed a data flow classification method based on an improved Harris Eagle algorithm combined with fuzzy C-means clustering. The method maps data flow samples to Harris Eagle population individuals, finds the optimal position through several iterations of the improved Harris Eagle optimization (IHHO) algorithm, and uses it as the initial clustering center to guide data flow classification by clustering according to the maximum membership principle, which improves the accuracy and stability of classification to some extent. Ref. [41] classified traffic flows under the protocol level. The researchers designed a dual-path autoencoder combining a convolutional autoencoder and a depth autoencoder for feature extraction and aggregation, then aggregating unknown traffic flows into multiple high-purity classes via correlation-adjusted clustering. The method achieves more than 98% classification accuracy on a predetermined number of 60 clusters. However, general clustering methods require knowledge of the number of clusters and need to be reclustered whenever a new class appears, which does not make good use of the previous clustering results.