3. The analysis system for unknown application layer protocols as in claim 2 , characterized in that, initial values of model parameter of the HSMM are selected as follows: a ij =1=/|S|, π i =1/|S|, k j (key)=1/|KEY|, 1 j,key (d)=ce −τ(d−|key|) , and for all i, jεS, keyεKEY, wherein [KEY] represents keyword number, |S|=M represents state number, |key| represents length of key, d represents length of the state, d−|key| represents the number of the rest characters except key in the duration of the state, τ represents an attenuation factor taking an empirical value of 5, c represents a normalization factor resulting in ∑ d ≥  key  ⁢ l j , key ⁡ ( d ) = 1 ; method of defining variables of the HSMM is as follows: a t (i) represents a forward variable being defined as α t (j)=P[S t] =j,o 1:t |λ],β t (i) represents a backward variable being defined as β t (i)=P[o t+1:T |S t] =i,λ], and ξ t (i,j), ψ t (j,kl) and ζ i (j,key,d) represent intermediate variables being defined respectively as ξ t (i,j)=P[S t] =i,S [t+1 =j,o 1:t |], ω t (j,kl)=P[S [t+]:t+kl =j,o 1:t |λ], and ζ t (j,key,d)=P[S [t−d+1t] =j,o t−d+1t−d+|key| =key,o 1:T |λ], whereas kl≧I is an integer.
2. The analysis system for unknown application layer protocols as in claim 1 , characterized in that, the HSMM is defined as follows: A state sequence corresponding to O t:t′ is S t:t =S t S t+1 . . . S t′ , wherein S k εS, represents the k th state corresponding to observation O k , k=t, t+1, . . . , t′, S t , S={1, 2, . . . , M} is the set of all states and M is the size of the set; a state ending at t′ is represented by S t′] ; a state starting at t is represented by S [t ; S [t:t′ represents a state started at t but not yet ended at t′ meaning S [t =S t+1 = . . . =S t′ ; S t:t′] represents a state already started before/at t and ended at t′ meaning S t =S t+1 = . . . =S t′] ; and S [t:t′] represents a state started at t and ended at t′ with a state length of t′−t+1 characters, meaning S [t =S t+1 = . . . =S t′] ; let a jj be a probability of transition from state i to state j, and ∑ j ⁢ ⁢ a ij = 1 is satisfied whereas a ii =0; initial probability of the state i is defined as π j ; KEY is defined as a set of all output values (i.e., observable keywords) of states, and k j (key) is defined as probability of key being output value (i.e., observed keyword) in the given state j, and ∑ key ⁢ ∈ ⁢ KEY ⁢ ⁢ k j ⁡ ( key ) = 1 is satisfied; when given state j and its output value being keyεKEY, probability of d≧[key] being length of continuation of the sate is I j,key (d), [key] is length of key and ∑ d ⁢ ⁢ l j , key ⁡ ( d ) = 1 is satisfied; and λ={a ii , π i , k i (key), I j , key(d)|i,jεS, keyεKEY, d≧[key ]} represents the set of all the model parameters.