## 4 Evaluation
### Contribution of Reviews  
We summarize some related reviews on tunnel detection in Table 11. [PERSON] [45] summarized the tunnel protocols between the application layer and the network layer, such as HTTP, DNS, SSH and ICMP, etc., and also summarized the idea of detecting \(\left\|A\circ B\right\|_{T}\) traffic by using time stamp, packet arrival interval and \(\left\|A\circ B\right\|_{S}\) with payload. [PERSON] [71] introduced TCP tunnel in detail to \(\left\|A\circ B\right\|_{S}\) and identified tunnel traffic from the message field. However, the protocol and detection methods described in this review are too monotonous and not suitable for most of the current situations. TCP tunnel traffic detection methods in \(\left\|A\circ B\right\|_{S}\) and \(\left\|A\circ B\right\|_{T}\) were summarized by [PERSON] [72], who briefly classified the applications in tunnel traffic. By using statistics and machine learning, [PERSON] [73] identified tunnel traffic using 109 technologies that hide protocol information through tunnels, simplified them into 11 patterns, and used statistics to identify tunnel traffic. Although they gave a variety of patterns, they failed to give a formal representation or give a specific detection method for each or fixed patterns. [PERSON] [74] regarded the tunnel from an attacker's perspective. By using bandwidth and entropy as metrics, the attacker can identify tunnel traffic by determining the probability of passing through the tunnel. Although this review has a novel angle, it failed to give an actual detection method, and as time goes by, the attack patterns of attackers may be updated iteratively. [PERSON] [75] summarized the \(\left\|A\circ B\right\|_{S}\) detection methods of embedded data in DNS requests and responses based on machine learning. Besides that, [PERSON] [76] introduced a plethora of literature, including rule-based and model-based methods. However, they only identified whether the tunnel traffic or not in DNS tunnel and failed to give fine-grained classification methods. At present, this kind of detection is not enough for all kinds of behaviors mixed in tunnel traffic. According to [PERSON] [77], tunnel traffic identification is affected by three problems: the rapid advancement of network technology, switching techniques, and micro-protocols. A comprehensive analysis of traffic's metadata features and RF performance was performed by [PERSON] [78], who summarized the methods for detecting \begin{table}
\begin{tabular}{c c c c c c} \hline  & **Completion** & **Reproducibility** & **Complexity** & **Innovation** & **Distinguish Application** \\ \hline Rank & 1 & 2 & 3 & 4 & 5 \\ Weight & 0.4292 & 0.2782 & 0.1841 & 0.0648 & 0.0437 \\ \hline \end{tabular}
\end{table} 
Table 10: Evaluation indicators of tunnel detection. and classifying tunnel passenger protocols and tunnel applications. Based on the analysis of concealment, robustness, and transmission efficiency, [PERSON] [79] proposed three new network tunnels among streaming media, blockchain, and IPv6, described possible tunnel forms and provided a new idea for tunnel detection. This is a new summary of tunnel transmission environments, and so we should focus on a more novel detection environment to obtain better results. Figure 5: \(Cont.\)  
Figure 5: _Cont._  
Figure 5: Rank of contribution of 6 protocols in tunnel detection. (**a**) Contribution of HTTP tunnel conferences, (**b**) Contribution of HTTPS tunnel conferences, (**c**) Contribution of DNS Tunnel references, (**d**) Contribution of SSH tunnel conferences, (**e**) Contribution of CTP tunnel conferences and (**f**) Contribution of ICMP tunnel conferences. According to the background information, expert experience and engineering practice knowledge of tunnel traffic detection, we have also selected the most suitable criteria, including five indicators: protocol categories, granularity of distinguishing applications and behaviors, diversity of detection methods, computational complexity of methods (time complexity and space complexity) and compatibility.