A semi-supervised method for classifying unknown protocols

Network protocol classification is the foundation and vital method of network management, and plays an important role in intrusion detection. However, with the emergence of a number of new applications, there are more and more unknown application layer protocols. The traditional protocol classification method can efficiently and accurately classify known protocols, but it cannot accurately classify unknown protocols. In this study, we proposed a semi-supervised unknown application layer protocol classification method. In this method, the appropriate protocol flow statistical features are selected by the deep neural network with the aid of known application layer protocols. And then, the protocols are divided into different sets using an improved semi-supervised clustering algorithm. Using the protocol data experiment collected by the real world, the results show that our method can effectively classify unknown protocols and has high accuracy. The feature selection method based on deep neural network also has practical value.