# A Self-Supervised Learning Model for Unknown Internet Traffic Identification Based on Surge Period
## 2 Literature Review
### The Flow-Based Unknown Internet Traffic Identification Based on Deep Learning Features  
With the continuous maturity of deep learning algorithms, many people pay attention to automatically extracting Internet features by deep learning and further achieving accurate identification of large-scale Internet traffic [20]. With the help of deep learning, it is possible to calculate and find the hidden features in the original Internet traffic by back-propagation algorithms [21]. More importantly, it could effectively solve the problem of manual design and screening of statistical features in traditional algorithms. Thus far, deep learning has become the mainstream in identifying unknown Internet traffic.  
The convolutional neural network (CNN) is one of the deep learning algorithms widely adopted in unknown Internet traffic classification. It can automatically extract features in the original Internet traffic through different convolution kernels and realize classification and identification. For example, [PERSON] proposes a deep learning method based on CNN to realize unknown traffic identification [20]. It uses a payload of up to 1024 bytes as a data unit and maps it into a 32 \(\times\) 32 feature matrix of unknown Internet traffic. The work adopts the first 10 kinds of protocols for known protocol types and the other 3 Internet protocols as the simulation data for unknown protocol types. Moreover, [PERSON] also constructs a transfer learning approach based on a deep adaption network, which consists of multiple convolutional layers and a fully connected layer [22]. It trains the CNN model based on features sampled from the Internet traffic and then extends them to the labeled and unlabeled samples. The method is finally demonstrated with a relatively improved performance based on two public datasets of QUIC and Ariel. [PERSON] [21] adopts an Artificial Neural Network (ANN) to extract unknown Internet traffic features and realizes the final identification with an accuracy of 67.16% with a probability condition of 0.8.  
In addition, deep auto-encoder is also popular in dealing with unknown Internet traffic identification with no labels. For example, [PERSON] proposes an identification method of unknown Internet traffic based on embedding and deep auto-encoder [23]. He extracts the subsequence of packet payloads with n-grams as features, based on which the deep auto-encoder and deep clustering are adopted to realize unknown traffic identification. [PERSON] [24] also focuses on unknown Internet traffic identification in an open-collection environment. In his experiment, he constructs a model based on CNN and a transformer encoder and selects five types of unknown Internet traffic manually, with a final identification precision of around 70%. [PERSON] also uses a deep auto-encoder to automatically extract the traffic features and realize the unknown Internet traffic identification [14]. The original traffic is converted into 20 \(\times\) 20 data blocks as an input of the deep auto-encoder, based on which the unknown traffic identification is realized through the BIRCH clustering algorithm. However, the method also has shortcomings, especially in dealing with background traffic, which greatly impacts the recognition accuracy.  
Compared with statistical features, the features trained and learned by deep learning depend more on the structures and properties of the traffic data itself. It could largely reduce the human labor involved in designing, selecting, and filtering the most appropriate statistical features automatically. Hence, deep learning methods will have more possibilitiesin terms of accuracy and efficiency when dealing with the identification of emerging unknown Internet traffic.