Exploring Unsupervised Learning Methods for Automated Protocol Analysis
  The ability to analyse and differentiate network protocol traffic is crucial
for network resource management to provide differentiated services by Telcos.
Automated Protocol Analysis (APA) is crucial to significantly improve
efficiency and reduce reliance on human experts. There are numerous automated
state-of-the-art unsupervised methods for clustering unknown protocols in APA.
However, many such methods have not been sufficiently explored using diverse
test datasets. Thus failing to demonstrate their robustness to generalise. This
study proposed a comprehensive framework to evaluate various combinations of
feature extraction and clustering methods in APA. It also proposed a novel
approach to automate selection of dataset dependent model parameters for
feature extraction, resulting in improved performance. Promising results of a
novel field-based tokenisation approach also led to our proposal of a novel
automated hybrid approach for feature extraction and clustering of unknown
protocols in APA. Our proposed hybrid approach performed the best in 7 out of 9
of the diverse test datasets, thus displaying the robustness to generalise
across diverse unknown protocols. It also outperformed the unsupervised
clustering technique in state-of-the-art open-source APA tool, NETZOB in all
test datasets.
