A Review of Clustering Techniques for Unknown Protocols Based on Network Traffic
Zhenhong Nian, Yonghao Wang, Rui Lou, Jing Jing · 2025
In the face of an expanding array of unknown protocols, conventional protocol reverse engineering methodologies are proving to be inadequate in addressing the intricacies of complex network environments. Consequently, automated clustering techniques have emerged as a pivotal area of research interest. This paper reviews the key techniques in unknown protocol clustering, including feature extraction, clustering algorithms and evaluation methods. The paper undertakes a comprehensive analysis of diverse strategies, underpinned by rule-based, statistical, machine learning and deep learning methods. The discussion encompasses the challenges posed by current methods, including redundant field interference, noisy sample effects, and parameter sensitivity, along with potential avenues for enhancement and optimization. The future direction of this research is expected to be the combination of deep learning and adaptive clustering, which is predicted to enhance the automation of unknown protocol analysis and provide more efficient solutions for cyber security.