1. An analysis system for unknown application layer protocols, characterized in that: it comprises the following processing modules: a) A module for collecting unknown application layer data; it is used for online identification of various known applications and storing of unidentifiable application layer data into a disk; b) A module for performing cluster analysis on unknown applications; it is used for performing cluster analysis on collected data and treating each resulting cluster as an unknown application; c) A module for performing reversed engineering on unknown application layer protocols; it is used for optimal partitioning of message sequences based on hidden semi-Markov model (HSMM) to obtain protocol keywords, message formats, dialogue rules and status transfer relations of the unknown applications.