# Fine-Grained High-Utility Dynamic Fingerprinting Extraction for Network Traffic Analysis
## 3 Data Processing
### Network Traffic Segment
Among the six basic attributes shared by network packets, three attributes can be used as network traffic partitioning: time, source IP address, and destination IP address. In this paper, network traffic is considered as a whole to determine the \"breakpoint\", and the partition performance of these three attributes in dividing network traffic is proved from the perspective of information entropy in information theory. This paper introduces information entropy to calculate the information value contained in a sample. The basic idea is that if each element in a sample has a specific rule, it can be determined according to statistical methods, and its change content can be predicted in advance, which means that the information value of this sample is not high, and the information entropy contained in it is small. On the contrary, if all elements of the sample are disordered and the specific situation is unpredictable, the amount of information  
Figure 5: Encrypted communication process. contained in the sample will be large, and the information entropy will naturally be larger. Equation (1) is the definition of information entropy:  
\[H(X)=-\sum_{x\in X}p(x)\log p(x) \tag{1}\]  
The network traffic classification process is to divide the packets according to the properties of continuous discretization into information entropy smaller fragments, and each fragment contains less information entropy, which means that the element is regular and will repeat. This is the same as the nature of the application of a fingerprint; the information entropy is small and it will repeat traffic division and be representative. In addition, it can be used as an application fingerprint to identify traffic. Information gain is used as the measurement standard when selecting partition attributes. Information gain is the change that occurs before and after the dataset is partitioned, and (2) is the definition of information gain:  
\[Info_{G}=H(X)-\sum_{i\in X}i\cdot H(X)_{i} \tag{2}\]  
The classification process can be described in a tree structure, in which \(H(X)\) represents the entropy of attributes of the parent node and \(H(X)_{i}\) represents the entropy of attributes of several child nodes. The larger the information gain \(Info_{G}\) is, the more information is contained before classification. The more impure the sample elements are, the smaller the information entropy after classification is, and the purer the sample elements of the child nodes will be. Each sample is more representative of the applied fingerprint, so the division based on IP address is better than the division based on time. In network traffic, network packets are continuous-discrete samples and network traffic is \(T_{f}\) packet sequence \(seq_{T}=\{p_{1},p_{2},\cdots,\ p_{i}\cdots,p_{N}\}\), while \(p_{i}\)\(=(\Delta t_{i},\{IP_{src},IP_{dst}\})\), \(\Delta t_{i}\) is the time difference between adjacent packets and \(\{IP_{src},IP_{dst}\}\) is the IP addresses at both ends of communication for unified analysis, regardless of the order. Therefore, according to the method of time interval division, the information gain of the obtained samples is:  
\[Info_{G}(T)=H(\Delta T)-\sum_{i\in p_{i}}i\Delta H(\{IP_{src},IP_{dst}\}) \tag{3}\]  
\(H(\Delta T)\) is the network traffic time interval of information entropy, as shown in (4):  
\[H(\Delta T)=\ -\sum_{\Delta t_{i}\in T}p(\Delta t_{i})\log\ p(\{\Delta t_{i}\}) \tag{4}\]  
\(H(\{IP_{src},IP_{dst}\})\) is the information entropy in the \(i\)th partition, which can be calculated as follows:  
\[H(\{IP_{src},IP_{dst}\})=-\sum_{i}p(MT_{i})\log p(MT_{i}) \tag{5}\]  
Another division method is based on IP address division \(\{IP_{src},IP_{dst}\}\). The calculation method is as follows:  
\[Info_{G}(\{IP_{src},IP_{dst}\})=H(\{IP_{src},IP_{dst}\})-\sum_{i\in\Delta T}i \cdot H(\Delta T_{i})=-\sum_{i\in p_{i}}p(MT_{i})-\sum_{i\in p_{i}}i(-\sum_{ \Delta t_{i}\in T}p(\Delta t_{i})\log p(\Delta t_{i})) \tag{6}\]  
In the actual division process, only the data flow is divided into small fragments.