# Fine-Grained High-Utility Dynamic Fingerprinting Extraction for Network Traffic Analysis
## 5 Experimental Analysis
### IAT Traffic Segment Experiment  
The first step is traffic partitioning. According to the IAT address partitioning method proposed above, the following table shows the number of application fingerprints after partitioning. As can be seen from Table 10, the average length of a fingerprint has a relation with the number of packets and application category, such as that the video class fingerprint is long, because the video class sends traffic that is bigger, and users in general will finish loading the video they are watching. When a large amount of data are collected and more application analogies are used, the advantages of IAT address division will gradually expand, and the average fingerprint length will rapidly decrease. With a shorter fingerprint length, the extracted features will be more typical, and the traffic classification effect will be better. As can be seen from Table 10, the information gain of data stream division by IAT is higher than that by time division. The reason is that the data stream divided by time has great contingency, the slice repeatability is small, the information entropy is still large, and the nodes are not pure. Therefore, the repeatability of the application fingerprint is very high, and only dozens of application fingerprints can be extracted from the possibly large data stream. Moreover, when the data volume is large enough, the more applications are used, the more frequent the switching and switching between addresses, the shorter the fingerprint obtained, the greater the possibility of repetition, the more pure the node information is, and the greater the information gain will be. This indicates that the application fingerprint classification effect is better. First, calculate the information entropy of the entire network traffic, as shown in Formula (20). \[H(M)=-\sum_{x\in M}p(x)\log p(x)=-\sum_{x\in M}\frac{N_{x}}{N}\log\frac{N_{x}} {N} \tag{20}\]  
where \(M\) is the message type, including TCP, HTTP, POP, and TLS. Then, the information entropy of the whole data stream can be obtained by calculating the probability of different \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Name**} & \multirow{2}{*}{**Time (min)**} & \multirow{2}{*}{**Packet Number**} & \multicolumn{2}{c}{**Application**} & \multicolumn{1}{c}{**Average**} \\  & & & **Fingerprint Number** & **Fingerprint Length** \\ \hline Dataset1 & 30 & 1755 & 441 & 3.97 \\ Dataset2 & 5 & 115,106 & 6830 & 16.85 \\ Dataset3 & 5 & 139,193 & 9104 & 15.28 \\ Dataset4 & 5 & 73,912 & 7643 & 9.67 \\ Dataset5 & 5 & 76,269 & 6986 & 10.91 \\ Dataset6 & 5 & 68,537 & 7366 & 9.30 \\ Dataset7 & 10 & 102,846 & 13,857 & 7.42 \\ Dataset8 & 15 & 182,292 & 149,683 & 1.21 \\ Dataset9 & 20 & 82,354 & 7395 & 11.13 \\ Dataset10 & 40 & 28,884 & 3735 & 7.73 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Dataset. types of messages under different protocols. First, the data packet is divided according to the IAT method, and then the information entropy of the divided data stream is calculated, as shown in Formula (21). \[H_{IAT}(\{IP_{src},IP_{dst}\})=\sum_{j}H_{j}(\{IP_{src},IP_{dst}\})=\sum_{j}(- \sum_{i}p(MT_{i})\log p(MT_{i})) \tag{21}\]  
\(H_{j}(\{IP_{src},IP_{dst}\})\) is the information entropy of each segment in the network traffic, and the corresponding information gain is the following:  
\[Info_{G}(\{IP_{src},IP_{dst}\})=H(M)-H_{IAT}(\{IP_{src},IP_{dst}\}) \tag{22}\]  
To compare with the division of time intervals, the number of fragments divided by the two methods should be as close as possible. If the number of fragments divided by IAT is \(N_{IAT}\), the corresponding time interval is \(\frac{N}{N_{IAT}}\).