{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,31]],"date-time":"2026-03-31T10:24:17Z","timestamp":1774952657295,"version":"3.50.1"},"reference-count":31,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2025,1,18]],"date-time":"2025-01-18T00:00:00Z","timestamp":1737158400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Zhejiang Provincial Department of Science and Technology\u2019s \u201cElite\u201d R&amp;D Program Project","award":["2024C01019"],"award-info":[{"award-number":["2024C01019"]}]},{"name":"Zhejiang Provincial Department of Science and Technology\u2019s \u201cElite\u201d R&amp;D Program Project","award":["2024C01108"],"award-info":[{"award-number":["2024C01108"]}]},{"name":"Zhejiang Provincial Department of Science and Technology\u2019s \u201cElite\u201d R&amp;D Program Project","award":["LQ20F020003"],"award-info":[{"award-number":["LQ20F020003"]}]},{"name":"Key Research and Development Program of Zhejiang Province","award":["2024C01019"],"award-info":[{"award-number":["2024C01019"]}]},{"name":"Key Research and Development Program of Zhejiang Province","award":["2024C01108"],"award-info":[{"award-number":["2024C01108"]}]},{"name":"Key Research and Development Program of Zhejiang Province","award":["LQ20F020003"],"award-info":[{"award-number":["LQ20F020003"]}]},{"name":"Zhejiang Provincial Natural Science Foundation of China","award":["2024C01019"],"award-info":[{"award-number":["2024C01019"]}]},{"name":"Zhejiang Provincial Natural Science Foundation of China","award":["2024C01108"],"award-info":[{"award-number":["2024C01108"]}]},{"name":"Zhejiang Provincial Natural Science Foundation of China","award":["LQ20F020003"],"award-info":[{"award-number":["LQ20F020003"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Algorithms"],"abstract":"<jats:p>Most network attacks occur at the application layer, where many application layer protocols exist. These protocols have different structures and functionalities, posing feature extraction challenges and resulting in low identification accuracy. This significantly affects application layer protocol recognition, analysis, and detection. We propose a data protocol identification method based on a Residual Network (ResNet) to address this issue. The method involves the following steps: (1) utilizing a delimiter determination algorithm based on information entropy proposed in this paper to determine an optimal set of delimiters; (2) segmenting the original data using the optimal set of delimiters and constructing a feature data block frequency table based on the frequency of segmented data blocks; (3) employing a composite-feature-based RGB image generation algorithm proposed in this paper to generate feature images by combining feature data blocks and original data; and (4) training the ResNet model with the generated feature images to automatically learn protocol features and achieve classification recognition of application layer protocols. Experimental results demonstrate that this method achieves over 98% accuracy, precision, recall, and F1 score across these four metrics.<\/jats:p>","DOI":"10.3390\/a18010052","type":"journal-article","created":{"date-parts":[[2025,1,20]],"date-time":"2025-01-20T10:32:15Z","timestamp":1737369135000},"page":"52","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["Application Layer Protocol Identification Method Based on ResNet"],"prefix":"10.3390","volume":"18","author":[{"given":"Zhijian","family":"Fang","sequence":"first","affiliation":[{"name":"School of Computer Science and Technology (School of Artificial Intelligence), Zhejiang Sci-Tech University, Hangzhou 310018, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiang","family":"Gao","sequence":"additional","affiliation":[{"name":"School of Information Science and Engineering, Zhejiang Sci-Tech University, Hangzhou 310018, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2902-9662","authenticated-orcid":false,"given":"Huaxiong","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology (School of Artificial Intelligence), Zhejiang Sci-Tech University, Hangzhou 310018, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jingpeng","family":"Tang","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Utah Valley University, Orem, UT 84058, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qiang","family":"Gao","sequence":"additional","affiliation":[{"name":"School of Media Engineering, Communication University of Zhejiang, Hangzhou 310018, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2025,1,18]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Marksteiner, S., Jimenez, V.J.E., Valiant, H., and Zeiner, H. (2017, January 23\u201324). An overview of wireless IoT protocol security in the smart home domain. Proceedings of the 2017 Internet of Things Business Models, Users, and Networks, Copenhagen, Denmark.","DOI":"10.1109\/CTTE.2017.8260940"},{"key":"ref_2","first-page":"3701","article-title":"Internet of vehicles: Architecture, protocols, and security","volume":"5","author":"Zeadally","year":"2017","journal-title":"IEEE Internet Things J."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"122","DOI":"10.1109\/MCOM.2017.1600267CM","article-title":"Security and privacy in smart city applications: Challenges and solutions","volume":"55","author":"Zhang","year":"2017","journal-title":"IEEE Commun. Mag."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Drias, Z., Serhrouchni, A., and Vogel, O. (2015, January 5\u20137). Analysis of cyber security for industrial control systems. Proceedings of the 2015 International Conference on Cyber Security of Smart Cities, Industrial Control System and Communications (SSIC), Shanghai, China.","DOI":"10.1109\/SSIC.2015.7245330"},{"key":"ref_5","first-page":"480","article-title":"Crime aspect of telemedicine on health technology","volume":"9","author":"Tarigan","year":"2018","journal-title":"Int. J. Civ. Eng. Technol."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"13","DOI":"10.1002\/poi3.296","article-title":"Centrality and power. The struggle over the techno-political configuration of the Internet and the global digital order","volume":"14","author":"Pohle","year":"2022","journal-title":"Policy Internet"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Deri, L., and Fusco, F. (2021, January 26\u201328). Using deep packet inspection in cybertraffic analysis. Proceedings of the 2021 IEEE International Conference on Cyber Security and Resilience(CSR), Virtual.","DOI":"10.1109\/CSR51186.2021.9527976"},{"key":"ref_8","first-page":"192","article-title":"Unknown wireless protocol feature extraction method based on sequence statistics","volume":"47","author":"Liu","year":"2021","journal-title":"Comput. Eng."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Wang, W., Bai, B., Wang, Y., Hei, X., and Zhang, L. (2019, January 10\u201313). Bitstream protocol classification mechanism based on feature extraction. Proceedings of the 2019 International Conference on Networking and Network Applications(NaNA), Daegu, Republic of Korea.","DOI":"10.1109\/NaNA.2019.00050"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Ma, R., and Qin, S. (2017, January 13\u201316). Identification of unknown protocol traffic based on deep learning. Proceedings of the 2017 3rd IEEE International Conference on Computer and Communications(ICCC), Chengdu, China.","DOI":"10.1109\/CompComm.2017.8322732"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"76731","DOI":"10.1109\/ACCESS.2022.3192458","article-title":"Fingerprinting technique for youtube videos identification in network traffic","volume":"10","author":"Afandi","year":"2022","journal-title":"IEEE Access"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"103186","DOI":"10.1016\/j.jnca.2021.103186","article-title":"Machine learning based malicious payload identification in software-defined networking","volume":"192","author":"Cheng","year":"2021","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"3317","DOI":"10.1007\/s11227-018-2517-0","article-title":"An improved method in deep packet inspection based on regular expression","volume":"75","author":"Sun","year":"2019","journal-title":"J. Supercomput."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"108528","DOI":"10.1016\/j.comnet.2021.108528","article-title":"Grammatch: An automatic protocol feature extraction and identification system","volume":"201","author":"Ma","year":"2021","journal-title":"Comput. Netw."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"164454","DOI":"10.1109\/ACCESS.2021.3134697","article-title":"Association analysis and identification of unknown bitstream protocols based on composite feature sets","volume":"9","author":"Wang","year":"2021","journal-title":"IEEE Access"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"672911","DOI":"10.1155\/2021\/6672911","article-title":"Nowhere to hide: A novel private protocol identification algorithm","volume":"2021","author":"Shi","year":"2021","journal-title":"Secur. Commun. Netw."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"583","DOI":"10.1109\/TNET.2014.2381230","article-title":"A semantics-aware approach to the automated network protocol identification","volume":"24","author":"Yun","year":"2015","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"3792205","DOI":"10.1155\/2022\/3792205","article-title":"An Unknown Protocol Identification Method for Industrial Internet","volume":"2022","author":"Zhu","year":"2022","journal-title":"Wirel. Commun. Mob. Comput."},{"key":"ref_19","first-page":"765","article-title":"Classification and Recognition of Unknown Network Protocol Characteristics","volume":"36","author":"Wang","year":"2020","journal-title":"J. Inf. Sci. Eng."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Liu, Z., Zha, X., Song, G., and Yao, Q. (2020, January 25\u201327). Unknown wireless network protocol feature extraction method based on sequence association. Proceedings of the 2020 5th International Conference on Mechanical, Control and Computer Engineering (ICMCCE), Harbin, China.","DOI":"10.1109\/ICMCCE51767.2020.00420"},{"key":"ref_21","unstructured":"Wei, H. (2023). Research on Reverse Analysis Method for State Characteristics of Unknown Network Protocol, Xi\u2019an University of Technology."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"012071","DOI":"10.1088\/1742-6596\/1617\/1\/012071","article-title":"Classification and identification of unknown network protocols based on CNN and T-SNE","volume":"1617","author":"Xue","year":"2020","journal-title":"J. Phys. Conf. Ser. IOP Publ."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"116255","DOI":"10.1109\/ACCESS.2023.3325391","article-title":"CNNPRE: A CNN-Based Protocol Reverse Engineering Method","volume":"11","author":"Garshasbi","year":"2023","journal-title":"IEEE Access"},{"key":"ref_24","first-page":"8955","article-title":"Clustering unknown network traffic with dual-path autoencoder","volume":"35","author":"Fu","year":"2023","journal-title":"Neural Comput. Appl."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"275","DOI":"10.23919\/JCC.ea.2022-0254.202401","article-title":"Unknown application layer protocol recognition method based on deep clustering","volume":"21","author":"Wu","year":"2024","journal-title":"China Commun."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"3871","DOI":"10.1007\/s00521-020-05442-0","article-title":"Complex communication application identification and private network mining technology under a large-scale network","volume":"33","author":"Huang","year":"2021","journal-title":"Neural Comput. Appl."},{"key":"ref_27","first-page":"3615","article-title":"Application layer protocol recognition method based on convolutional neural networks","volume":"39","author":"Feng","year":"2019","journal-title":"Comput. Appl."},{"key":"ref_28","unstructured":"Mrdovic, S., and Drazenovic, B. (2010, January 8\u20139). KIDS\u2013Keyed Intrusion Detection System. Proceedings of the Detection of Intrusions and Malware, and Vulnerability Assessment: 7th International Conference, DIMVA 2010, Bonn, Germany. Proceedings 7."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"e2140","DOI":"10.1002\/nem.2140","article-title":"A message keyword extraction approach by accurate identification of field boundaries","volume":"31","author":"Goo","year":"2021","journal-title":"Int. J. Netw. Manag."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27\u201330). Deep residual learning for image recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Rosay, A., Cheval, E., Carlier, F., and Leroux, P. (2022, January 9\u201311). Network intrusion detection: A comprehensive analysis of CIC-IDS2017. Proceedings of the 8th International Conference on Information Systems Security and Privacy, Online. SCITEPRESS-Science and Technology Publications.","DOI":"10.5220\/0010774000003120"}],"container-title":["Algorithms"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-4893\/18\/1\/52\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,8]],"date-time":"2025-10-08T10:31:17Z","timestamp":1759919477000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-4893\/18\/1\/52"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,1,18]]},"references-count":31,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,1]]}},"alternative-id":["a18010052"],"URL":"https:\/\/doi.org\/10.3390\/a18010052","relation":{},"ISSN":["1999-4893"],"issn-type":[{"value":"1999-4893","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,1,18]]}}}