# Unknown Traffic Recognition Based on Multi-Feature Fusion and Incremental Learning
## 4 Evaluation  
### Datasets for Evaluation  
In real networks, new applications frequently produce unknown flows, particularly when encryption is involved. We used two publicly accessible datasets, ISCXVPN2016 and ISCXTor2016, and extracted some of the data to construct the dataset ISCX-VPN-Tor as experimental datasets to evaluate the performance of the proposed approach under different encrypted traffic scenario tasks. In the ISCXVPN2016 dataset, each class of traffic is encapsulated by regular encryption and VPN protocols. The traffic in the ISCXTor2016 dataset is encrypted by Tor technology. Both datasets were published by the University of New Brunswick, who created accounts to run a number of representative applications (such as facebook, skype, spotify, and gmail) on virtual machine workstations that were connected to the Internet through a gateway virtual machine, which in turn routed all traffic through the Tor network or VPN tunnel. Flows were generated from PCAP files captured at the gateway and labeled according to the applications executing on the workstations. The traffic in each dataset includes six application categories, namely Email, Chat, Streaming, File Transfer, VoIP, and P2P. Therefore, a total of 12 application categories of traffic are included in the experimental dataset, as detailed in Table 1. Dataset ISCX-VPN-Tor represents real-world VPN tunnel and Tor network traffic to some extent. Another intrusion detection dataset, NSL-KDD, was used to validate the detection performance of the proposed method for unknown attacks. NSL-KDD contains over 96,000 flows, including normal traffic and 22 attack patterns, namely DoS attacks, probe attacks, U2R attacks, and R2L attacks, as detailed in Table 2. This dataset was synthesized by the traffic generator, which is not fully representative of the traffic in a real environment but has become one of the relatively authoritative intrusion detection datasets in the field of network security due to its suitability for studying the characteristics of various attack \begin{table}
\begin{tabular}{c c c} \hline \hline
**Dataset** & **Traffic Classes** & **Number of Flow** \\ \hline \hline  & VPN-Email & 2054 \\  & Tor-Email & 1866 \\  & VPN-Chat & 1365 \\  & Tor-Chat & 1574 \\  & VPN-Streaming & 13,682 \\  & Tor-Streaming & 6839 \\  & VPN-File Transfer & 4732 \\  & Tor-File Transfer & 8874 \\  & VPN-VoIP & 3639 \\  & Tor-VoIP & 7680 \\  & VPN-P2P & 6635 \\  & Tor-P2P & 3453 \\ \cline{2-3} \cline{2-3}  & Total & 62,392 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The traffic categories of ISCX-VPN-Tor dataset. classes. From the statistics of the number of flows of various traffic categories of NSL-KDD, it can be seen that there is a traffic imbalance problem in this dataset, with normal samples accounting for most of the attack traffic, and DoS dominating the attack traffic, with U2R attacks accounting for a small percentage, which is a problem we needed to consider. In addition, we constructed a self-collected dataset, SelfDataset, by capturing traffic generated by commonly used scientific software as normal traffic and malicious traffic from malicious samples running in a sandbox. These malicious samples were also captured in real-world scenarios. A demo of the SelfDataset was used for conducting experiments, with a size of 4.18 GB, as shown in Table 3.  
Some applications in these datasets were chosen as the unknown classes, and the rest of the dataset was the known classes. We used 80% of the known samples to train the model and 10% of the known samples as the validation set to adjust the parameters of the model through the deviation from ground truth and improve its prediction performance. Furthermore, the remaining 10% of the known and all unknown samples was used as the test set to evaluate the proposed method.