# Unknown Traffic Recognition Based on Multi-Feature Fusion and Incremental Learning
## 5 Conclusions and Further Work
Our model may classify the unknown features of these known traffic categories as unknown traffic, leading to a high false negative rate. Therefore, there is a need for more adaptive and dynamic methods to keep up with the evolving nature of encrypted traffic. Furthermore, the robustness of our approach to adversarial attacks and evasion techniques is an area that requires further investigation. Attackers are constantly evolving their tactics to evade detection, and it is essential to develop defences that can effectively detect and mitigate these advanced evasion techniques. We plan to further investigate the model in the future in an effort to strengthen defences against attacks that use poisoned samples. In conclusion, although our method has demonstrated promising results, there are significant limitations that need to be addressed. Future research efforts should focus on developing adaptive and dynamic methods, tackle scalability challenges, and improve the robustness of the classification process against adversarial attacks. By addressing these limitations, we can further advance the field of traffic classification and contribute to the development of more effective and efficient solutions for network security. [PERSON] designed and developed the model and wrote the original draft; [PERSON] conceived the experimental ideas and reviewed the original draft; [PERSON], [PERSON] and [PERSON] helped with data analysis and constructive discussions. All authors have read and agreed to the published version of the manuscript. This study was partially supported by the Xiejialin Project of Institute of High Energy Physics under grant no. E25467U2 and the specialized project for cybersecurity and informatization in the 14 th Five-Year Plan of CAS under grant no. WX145 XQ12. Not applicable. The public dataset used to support the findings of this study can be found at: ISCXVPN2016: [[https://www.unb.ca/cic/datasets/vpn.html](https://www.unb.ca/cic/datasets/vpn.html)]([https://www.unb.ca/cic/datasets/vpn.html](https://www.unb.ca/cic/datasets/vpn.html)) (accessed on 1 May 2023), ISCXTor2016: [[https://www.unb.ca/cic/datasets/tor.html](https://www.unb.ca/cic/datasets/tor.html)]([https://www.unb.ca/cic/datasets/tor.html](https://www.unb.ca/cic/datasets/tor.html)) (accessed on 1 May 2023), NSL-KDD: [[https://www.unb.ca/cic/datasets/nsl.html](https://www.unb.ca/cic/datasets/nsl.html)]([https://www.unb.ca/cic/datasets/nsl.html](https://www.unb.ca/cic/datasets/nsl.html)) (accessed on 1 May 2023). The SelfDataset supporting the results of this study is not publicly available because it contains content that may relate to subsequent unpublished studies. The authors declare no conflict of interest. The following abbreviations are used in this manuscript:  
**Variable** & **Description**  
\(F_{AlexNet}\), \(F_{VGG16}\), and \(F_{LSTM}\)  
VGG16, and LSTM, respectively. \(F_{1}\), \(F_{2}\),..., \(F_{1000}\)  
1000 specific feature vectors extracted by each neural network. Different dimensions of each specific feature vector, for a total of \(f_{1}\), \(f_{2}\),..., \(f_{1000}\)  
256 dimensions. \(I(x,y)\)  
Mutual information of \(x\) and \(y\). \(x\), \(y\)  
Two different feature vectors.