# Unknown Traffic Recognition Based on Multi-Feature Fusion and Incremental Learning
## 3 Design of Framework
### Unknown Traffic Recognition  
A trained SVM multi-classifier is used to recognize the extracted and fused features from the previous step. We first construct the SVM classifier with \(N+1\) classes. If the feature belongs to a known traffic of class \(N\) in the training set, it is classified into a specific traffic class; otherwise, it is classified as unknown traffic and enters the unknown traffic identification process. The purpose of this process is to separate known traffic from unknown traffic to improve the accuracy of known traffic identification. Unlike the feature distribution pattern of known traffic, unknown traffic has certain similarities among similar features, but its spatial distribution is relatively random, and the shape of clusters is irregular, so it is obviously not feasible to classify unknown features using fixed distance  
proposed in this section, we divide the unknown features with sufficient density ratio into an unknown class. The feature points located in a very small neighborhood \(\epsilon\) of a feature \(f_{U}^{i}\) are define as \(\mathcal{N}_{\epsilon}(f_{U}^{i})\), those in a larger neighborhood \(\mu\) are calculated as \(\mathcal{N}_{\mu}(f_{U}^{i})\) in the same way, and the ratio of the number of the two is the density ratio \(\frac{|\mathcal{N}_{\epsilon}(f_{U}^{i})|}{|\mathcal{N}_{\mu}(f_{U}^{i})|}\). ```
Input: \(f_{Known}=\{(f_{K}^{1},y_{K}^{1}),(f_{K}^{2},y_{K}^{2}),\ldots,(f_{K}^{n},y_{K}^ {n})\}\)--Known features in the feature database, \(f_{Unknown}=\{(f_{U}^{1},f_{U}^{2},\ldots,f_{U}^{m})\}\)--Unknown features to be recognized, \(\epsilon\)--Small neighborhood radius, \(\mu\)--Larger neighborhood radius, \(\tau\)--Density radio threshold, \(T\)--Distance threshold. Output: \(C=\{Class_{1},Class_{2},\ldots,Class_{N}\}\)--Known class labels, \(C^{\prime}\)--New unknown class labels, \(Noi\)--Noise. 1 Mark all unknown features as unvisited ;
2 whileExist unvisited unknown featuresdo
3 Randomly select an unvisited unknown feature \(f_{U}^{i}\) and mark it as visited;
4 for\(j=1\) to \(m,j\
eq i\)do
5\(\mathcal{N}_{\epsilon}(f_{U}^{i})\leftarrow\{f_{U}^{i}\|f_{U}^{i}-f_{U}^{i}\| \leq\epsilon\}\) ;
6\(\mathcal{N}_{\mu}(f_{U}^{i})\leftarrow\{f_{U}^{i}\|f_{U}^{i}-f_{U}^{i}\| \leq\mu\}\) ;
7 if\(\frac{|\mathcal{N}_{\epsilon}(f_{U}^{i})|}{|\mathcal{N}_{\epsilon}(f_{U}^{i})|} \geq\tau\)then
8 Create a new cluster \(C^{\prime}\), and add \(f_{U}^{i}\) to \(C^{\prime}\) ; \(\mathcal{N}\leftarrow\mathcal{N}_{\epsilon}(f_{U}^{i})\) ;
9 for\(f_{U}^{p}\) in \(\mathcal{N}\)do
10 if\(f_{U}^{p}\) is unvisitedthen
11 Mark it as visited ;
12 for\(q=1\) to \(m,q\
eq p\)do
13\(\mathcal{N}_{\epsilon}(f_{U}^{p})\leftarrow\{f_{U}^{q}\|f_{U}^{p}-f_{U}^{q}\| \leq\epsilon\}\) ;
14\(\mathcal{N}_{\mu}(f_{U}^{q})\leftarrow\{f_{U}^{q}\|f_{U}^{q}-f_{U}^{q}\| \leq\mu\}\) ;
15
16 if\(\frac{|\mathcal{N}_{\epsilon}(f_{U}^{q})|}{|\mathcal{N}_{\epsilon}(f_{U}^{q})|} \geq\tau\)then
17\(\mathcal{N}\leftarrow\mathcal{N}\cup\mathcal{N}_{\epsilon}(f_{U}^{i})\) ;
18
19 if\(f_{U}^{p}\) is not a member of any clusterthen
20 Add \(f_{U}^{p}\) to \(C^{\prime}\) ;
21
22 Output \(C^{\prime}\) ;
23 elseif\(\|f_{U}^{i}-avg_{K}(Class_{i})\|\leq T\)then
24 Mark \(f_{U}^{i}\) as \(Class_{i}\);
25
26 else
27 Mark \(f_{U}^{i}\) as \(Noi\) ;
```  
**Algorithm 1**Unknown traffic classification. When the density ratio of a feature is greater than the set density threshold \(\tau\), a new unknown class \(C^{\prime}\) is created for it. The feature points that meet the requirements are selected in the same density ratio screening method within the neighborhood of the feature \(f_{U}^{i}\) and added to the newly created unknown class. That is to say, an unknown class is the largest set of features connected by the density ratio. If the neighborhood density ratio of the unknown feature does not reach the specified threshold, the distance is compared with the average feature of each known traffic category.