{'fraction_non_alphanumeric': 0.02224694104560623, 'fraction_numerical': 0.0, 'mean_word_length': 4.960264900662252, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
TMPM: Transfer Matrix with Path Memory for Feature Extraction of Unknown Protocol

With the increasing amount of data, various new protocols bring challenges to the traditional identification system. Inspired by Markov model, we bring in a new concept named “multi-level features”. Based on that, a Markov-Matrix model with path memory is proposed to extract unknown features. What's more, a large number of features extracted are screened, summarized and sorted by weight model and attention threshold. The experiments show that our model can extract unknown features from an ocean of protocols effectively and display them efficiently. At the same time, we limit the memory consumption of the model, and then use the real network data flow to simulate the unknown protocol feature extraction in the limited memory environment. The result shows that TMPM can complete the task well in a short time.