# Unknown Traffic Recognition Based on Multi-Feature Fusion and Incremental Learning
## 4 Evaluation
### Experiment Settings  
The testing and comparative experiments of the model were compiled with the support of a Nvidia Tesla T4 GPU. They were run on a Ubuntu 20.04 LTS operating system and implemented using Python 3.6.5. The main modules used in this experiment were TensorFlow 1.14.0 and sklearn 1.0.2. The workflow of the model is as follows: Python captures and parses the network traffic. The parsed traffic is collected by [PERSON] and sent to the pre-trained feature extraction and fusion module for processing. The results are then stored in a MySQL server as a feature database. The SVM classifier retrieves the traffic features from the MySQL database for classification. Unknown traffic features are clustered using the density-ratio-based clustering algorithm to form new categories, and labeled data are stored in the MySQL database. During this process, the classifier dynamically adjusts and updates. The classification results of the traffic can be visualized through a frontend interface. The pretraining of the model is completed on a GPU server, and the online model is deployed in Docker using TensorFlow Serving. Pretrained deep models are often adapted to a new task by means of transfer learning. The parameter values of the pretrained neural networks used in the experiments are given in Table 4. Each neural network had an input image size of \(32\times 32\), the models were optimized using stochastic gradient descent (SGD) with a momentum of 0.9, a decay of \(10^{-4}\), a mini-batch size of 32, and a learning rate of 0.001. The pretraining process of the model was able to be completed with high accuracy. However, the validation process of the pretrained model showed oscillation loss, indicating that the model could not fully converge. That is, the pretrained model could not fully learn the local features of the traffic. Figure 3 shows how the loss function changes when the model is pretraining. During the training process, the loss function gradually decreased until it reached a slower convergence speed after 80 steps. After 200 steps, it tended to converge. This demonstrates that the model has a good training speed. In order to measure the performance of the models, accuracy (_Acc_), true positive rate (\(TPR\)), false positive rate (\(FPR\)), \(FTF\), and F1 score (\(F1\)) metrics derived from the confusion matrix were used, and the formulations of the metrics are described in Equations (22)-(26). In the experiment, the unknown traffic flow was considered as positive samples. Thus, \(TP\) (true positive) and \(FP\) (false positive) in the equations are the number of unknown flows that were correctly determined to be unknown and incorrectly determined to be known, respectively; and \(TN\) (true negative) and \(FN\) (false negative) are the number of known flows that were correctly identified as known and incorrectly identified as unknown, respectively. As can be seen from the equations, _Acc_ characterizes the proportion of all flows that are correctly classified, \(TPR\) indicates the proportion of all unknown flows that are correctly predicted as unknown, and \(FPR\) indicates the proportion of all known flows that are incorrectly predicted as unknown. \(FTF\) takes both \(TPR\) and \(FPR\) into account, and \(F1\) is a metric that combines the precision and recall rate of a model. The \(kappa\) factor is also a measure of model consistency based on a confusion matrix that is calculated as shown in Equation (27), where \(p_{o}\) represents the overall classification accuracy, and \(p_{e}\) refers to the expected agreement rate. To evaluate the performance of different classification algorithms, we also plotted ROC curves and compared their _AUC_ values. \begin{table}
\begin{tabular}{c c} \hline \hline
**Neural Network Aachitecture** & **AlexNet/VGG16/LSTM** \\ \hline Input size & \(32\times 32\) \\ Optimization & SGD \\ Momentum & 0.9 \\ Decay & \(10^{-4}\) \\ Mini-batch & 32 \\ Learning rate & 0.001 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The parameter values of the pretrained neural networks.