# Application Layer Protocol Identification Method Based on ResNet
## 1 Introduction  
Network protocols form the cornerstone of Internet communication, dictating the transmission methods, formats, and rules for data exchange across networks, enabling communication and information exchange among different devices and applications. However, with the rapid growth of the Internet and the emergence of new technologies, traditional network protocols can no longer meet the increasing communication demands. The integration of a large number of Internet of Things (IoT) devices into the Internet ecosystem has led to the widespread application of network protocols in various fields, such as smartphones, smart homes [1], connected vehicles [2], smart cities [3], industrial control [4], and remote healthcare [5], facilitating communication and data exchange between devices. These IoT devices utilize various application layer protocols, such as HTTP, MQTT, DDS, AMQP, etc., to adapt to different requirements and application scenarios. In order to adapt to the needs of emerging applications and services, new protocols are continuously introduced and developed. Once registered by the Internet Assigned Numbers Authority (IANA) [6], these protocols become publicly available. Attackers canleverage this public information to gain insight into the workings of protocols and potential vulnerabilities, potentially launching attacks against these protocols. Therefore, research on application layer protocol recognition technology is of the utmost importance. Currently, mainstream methods include Deep Packet Inspection (DPI) [7], statistical methods based on feature extraction [8], machine learning methods [9], deep learning methods [10], and protocol fingerprinting methods [11]. These methods effectively identify application layer protocols, enhancing network security and ensuring the reliability of network communication. As the most used protocol recognition technology, DPI requires thoroughly examining packet headers, payload, and other information. However, this method faces challenges such as low efficiency, poor accuracy, and inability to handle encrypted traffic when processing large amounts of data streams. The protocol feature matching method involves establishing a protocol feature library to match network traffic with feature fingerprints for protocol identification. The workflow includes constructing a protocol fingerprint library, extracting traffic features, matching fingerprints, and identifying protocols. However, this method may be susceptible to influences such as encryption, compression, obfuscation, or variations in traffic, leading to reduced matching accuracy. Deep learning offers the advantage of automatically learning features, making it particularly effective for identifying network communication protocol data with distinct features. However, deep learning models typically require a large amount of computational resources. Training these models involves extensive matrix operations and floating-point calculations, which place high demands on hardware, especially for image or video datasets. The large number of parameters and computations significantly increase processing time. Therefore, by combining traffic features with deep learning methods, we improved protocol recognition speed and accuracy by enhancing data features, without modifying the model architecture. Our main contributions are as follows:  
1. Proposed an entropy-based delimiter determination algorithm: This algorithm utilizes information entropy and frequency to determine an optimal set of delimiters in application layer protocols. These delimiters are used to segment the original data, extract feature data blocks, and generate a feature table. 2. Introduced a composite-feature-based RGB image generation algorithm: This algorithm refines the original data using the feature table to obtain purified data with positional information. Subsequently, the original and purified data are merged to generate composite feature images.