# A Network Traffic Abnormal Detection Method: Sketch-Based Profile Evolution
## 4 Experiment and Result Analysis  
The experimental dataset is the network data captured in the actual environment through Wireshark [53]. The captured devices are two Android smart phones. Mobile phones are hooked up to video software such as Douyin (v4.2.0) and Tencent Video (v7.1.0.19832), news software programs such as Weibo (v9.4.0) and Toutiao (v7.1.3), communication software programs such as WeChat (v7.0.3) and QQ (v7.9.2), and life software programs such as Meituan (v9.11.802) and Ctrip (v8.1.0). We conducted long-term dataset collection in these running environments, and then cut specific time interval data packets from these datasets to obtain the dataset used in the experiment. The specific values of the dataset are shown in Table 2:  
The Background is the number of data packets captured by the mobile phone without any application running, and is mainly the data sent by the system itself and pushed by some applications. As can be viewed from Table 2, 932 data packets are obtained after \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Name** & **Nature Category** & **Time/min** & **Number of Packets** \\ \hline Background & Background traffic & 15 & 932 \\ Video & Video traffic & 10 & 230,211 \\ News & News traffic & 10 & 278,386 \\ Communication & Communication traffic & 10 & 147,823 \\ Life & Life traffic & 10 & 152,538 \\ Mix1 & Mixed traffic & 5 & 67,986 \\ Mix2 & Mixed traffic & 10 & 108,726 \\ Mix3 & Mixed traffic & 15 & 180,578 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Dataset. Figure 7: SPE algorithm. 15 min of rest, which is the same as the number of data packets with other applications running, and is negligible. Video, News, Communication, and Life are the traffic conditions obtained by running only video software, news software, communication software, and life software, respectively. Mix1, Mix2, and Mix3 are the mixed flow statuses obtained via running all the software programs of the mobile phone for 5, 10, and 15 min, respectively. At the same time, in order to simulate the situation of receiving abnormal traffic during actual use, we make the above datasets into abnormal traffic datasets with abnormal characteristics by sending malicious code to the device that is grabbing traffic packets irregularly. To evaluate the performance of the SPE algorithm, we conducted the following three parts of the experiment as follows:  
The first part of the experiment is to study the performance of the TG generated by the structured network traffic. Consistency Degree (\(CD\)) is used to measure the stability and sensitivity of the TG. The similarity of the TG formed by the same type of network traffic is relatively high. The similarity of TGs formed by different types of network traffic is relatively low, as shown in Equation (28):  
\[CD=\frac{(2\mu_{a}\mu_{b}+l_{1})(2\sigma_{ab}+l_{2})}{(\mu_{a}^{2}+\mu_{b}^{2}+ l_{1})(\sigma_{a}^{2}+\sigma_{b}^{2}+l_{2})} \tag{28}\]  
where \(\mu_{a}\) and \(\mu_{b}\) are the mean values of the pixels of \(a\) and \(b\) in the graph, \(\sigma_{a}^{2}\) and \(\sigma_{b}^{2}\) are the variances of \(a\) and \(b\), \(\sigma_{ab}\) is the covariance of \(a\) and \(b\), \(l_{1}\) and \(l_{2}\) are the stabilization parameters, and scale is the range of pixels. Figure 8 shows the continuity of the datasets for Video, News, Communication, and Life, respectively. Each dataset generates a TG every 10 s to calculate the continuity of adjacent images. The \(X\)-axis represents the generated x-th TG. According to the curve in Figure 8, the continuity of the TG of video traffic is not much different, and the curve fluctuation is relatively small because the data packets captured from video applications are relatively similar. News applications include pictures, meanwhile, and there are various types of data such as video and text, so the fluctuation range of the TG is relatively large and the continuity is relatively low, indicating that the Profile of network traffic has changed. Figure 8: Consistency Degree comparison of Traffic Graph in a different dataset.