# Application Layer Protocol Identification Method Based on ResNet
## 4 Experimental Results and Discussion
### Experimental Results and Analysis
#### 4.4.2 Generation of Feature Data Block Frequency Table  
We separate 784 bytes of data using the optimal delimiter set and generate a feature frequency table based on the frequency of feature data blocks, which serves as the protocol feature. The characteristic frequencies of some protocols are shown in Table 5, which presents the result of the optimal delimiter set we have selected. \begin{table}
\begin{tabular}{c c} \hline \hline
**Group** & **Delimiters** \\ \hline A & CR LF SPACE NULL,..:/ \&? = (){}[]\"; \textless{}> \\ B & LF NULL!=\"\%\"+,../:@ \_? = \\ C & LF NULL,..:/ \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Contrasting experiment delimiters. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Protocol** & **Symbol** & **Information Entropy** & **Frequency** \\ \hline  & SPACE & 1.402 & 792 \\  & CR & 1.282 & 767 \\ BGP & LF & 1.275 & 767 \\  & : & 1.257 & 767 \\  & : & 0.381 & 299 \\  & SPACE & 1.908 & 695 \\ SMB & LF & 0.565 & 695 \\  & \(\backslash\) & 0.213 & 695 \\  & SPACE & 2.397 & 271 \\  & / & 1.938 & 523 \\ HTTP & : & 1.893 & 253 \\  & CR & 1.721 & 325 \\  & LF & 1.602 & 325 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Partial symbol information entropy and frequency table. The data in the table indicate that in the BGP protocol, the fields \"21\", \"NOTIFICA-TION\", \"Code\", and \"Subcode\" have high frequencies of occurrence across the four groups. Upon verification, \"21\" represents the value of length in the protocol and is not a feature of the BGP protocol; however, all other data are indeed features of the BGP protocol. In the SMB protocol, the more delimiters used, the better the segmentation effect. By comparing Group A with Group C, it can be inferred that all data in Group A are feature data. When comparing Group A with our group, the segmentation results are similar, but because our group has fewer delimiters, the program runs faster and takes less time. In the HTTP protocol, only \"Connection\" belongs to the HTTP feature in the data blocks segmented by Group B and Group C, as time-related fields such as \"GMT\" and \"2017\" occur frequently due to time fields in the HTTP message header. In contrast, Group A's and our group's data features are more accurate. From a temporal perspective, Group B contains many delimiters that do not exist in the original data, so during program execution, these delimiters are only searched but not used for segmentation operations, resulting in a shorter runtime. Group C has the fewest delimiters, resulting in the shortest runtime. However, Group A has the longest runtime because it has the most delimiters, and these delimiters occur frequently in the original data, leading to more segmentation operations. Although our group has significantly fewer delimiters than Group A, these symbols are selected based on information entropy and frequency, resulting in more occurrences in the original data and, therefore, a longer runtime. This suggests that, taking into account both runtime and feature block accuracy, the delimiter obtained by our proposed algorithm is the optimal solution.