Automatic determination of types number of mixed binary protocols

In the absence of prior knowledge, it is a challenge to determine the number of protocol types in frames, which are completely unknown. These frames might be mixed with multiple protocols from the data link layer to the application layer. In this study, the authors combine the spectral clustering algorithm with a method of determining the number of protocol frame types, and further more design the refinement clustering of different hierarchical protocols based on the eigenvectors of the Laplace matrix. They use three clustering validity indices, which are Calinski-Harabasz index, Davies-Bouldinn index and Silhouette index, to quantify the clustering effect in order to calculate the number of protocol types. Extensive experiments on several open datasets obtain relatively satisfying results without prior knowledge and demonstrate the significant advantages of their methods clearly.