Traffic Type Recognition Method for Unknown Protocol—Applying Fuzzy Inference

Round 1

Reviewer 1 Report

My comments:
1. The topic of this paper is interesting and it will make a lot of contribution in related research field -- Traffic Type Recognition Method for Unknown Protocol – Applying Fuzzy Inference

2. The “Motivational Case Study”, “Traffic Type Recognition Algorithm”, and “Experimental Research” are well presented.
3. It had better to add the “Discussion” before “Conclusion”.
4. If possible, the “Conclusion” may reinforce more. For example, the contributions to academic research as well as theoretical implications and research limitations.

Author Response

Hello.
First of all, thank you for the comments on my manuscript.

I have revised my manuscript accordingly, and the contents are as follows.

1. It had better to add the “Discussion” before “Conclusion”.

• Following the instructions from Electronics, "Conclusion" was removed and lines 507 to 543 were merged into "Discussion".

2. If possible, the “Conclusion” may reinforce more. For example, the contributions to academic research as well as theoretical implications and research limitations.

• Lines 534 through 543 stated theoretical implications and research limitations and reinforced with several additions about interpretation of the results and the limitations in more detail.

Thank you.

Reviewer 2 Report

Summary: This manuscript proposes an algorithm that recognize various types of traffic without having information of static features. The algorithm combines protocol analysis based on ecological sequence alignment algorithm in fuzzy inference system. The fuzzy inference-based protocol analysis traffic recognition algorithm obtained up to 91 percent of level of performance by using data set containing various types of traffic including: Chat, Email, File, P2P, Stream, and VoIP. The results showed a high accuracy of 82.5 percent which has lowered the amount of data to the level of at least 40 percent.

Evaluation: The organization of paper is good, experiments well explained, and proofs and mathematical reasoning are clear. The results are explained in detail. The references are good.

Comments: The author should explain a little about the Gaussian model, Triangular model and Trapezoidal model and their equations as well as their application in the manuscript.

In Figure 14, the accuracy trend according to the amounts of learning traffic for PP is the same for all cases: full-data, 80% data, 60% data and 40% data, but for FP, it has increased from 18.3 in full data to 20.8 in 40% data. For confidence, it has increased from 68.8 percent in full data to 69.2 percent for 40% data. The author should answer why the accuracy trend for PP is constant for all cases, but it is not the same for FP and confidence?

About the Figures, it is suggested the author explain more in details.

It is suggested that the author edit the manuscript because of English grammar.

Author Response

Hello.
First of all, thank you for the comments on my manuscript.

I have revised my manuscript accordingly, and the contents are as follows.

1. The author should explain a little about the Gaussian model, Triangular model and Trapezoidal model and their equations as well as their application in the manuscript.

• To demonstrate application of each model, I insert detailed explanation for each type of model. Application for our experiments explained next paragraph: lines 291 to 293

2. In Figure 14, the accuracy trend according to the amounts of learning traffic for PP is the same for all cases: full-data, 80% data, 60% data and 40% data, but for FP, it has increased from 18.3 in full data to 20.8 in 40% data. For confidence, it has increased from 68.8 percent in full data to 69.2 percent for 40% data. The author should answer why the accuracy trend for PP is constant for all cases, but it is not the same for FP and confidence?

• Because the data used for training have changed, the judgment values that make up the IF THEN rule have changed. Therefore, the confidence value inevitably changed, but the PP value was constant for the same test data, so the ability to understand the characteristics of the target traffic was secured. However, the rise in the FP indicator appears to have unintentionally increased the flexibility of the judgment criteria. We have briefly added this to lines 482 to 488.

3. About the Figures, it is suggested the author explain more in details.

• I reinforced footnotes in Figure 4, 8, 9, 14, 15. More explanations about some figures are added: lines 217 to 219, lines 311 to 312, lines 360 to 361.

Thank you.