## 3 Experiment Workflow
### Feature Engineering  
Feature engineering leverages domain knowledge by creating features that enhance the performance of ML algorithms. This involves transforming raw data into a more conducive format for modelling. Replacing the raw data with its features improves the model training. Although deep learning architectures can capture intricate features on their own, they require large datasets and significant computational resources to train. \begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Activity** & **Length (min)** & **Average (MB/s)** & **Variance (MB/s)** & **Source** \\ \hline File download & 167 & 4.92 & 0.6 & Author’s \\ Gaming session & 148 & 1.10 & 1.05 & measurements \\ Facebook browsing & 167 & 0.89 & 1.21 & \\ YouTube & 180 & 0.67 & 1.11 & [22] \\ Netflix & 180 & 0.44 & 0.97 & [22] \\ Prime Video & 180 & 0.52 & 0.44 & [22] \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Network throughput traces used in the experiments. Figure 3: Fragments of the traffic traces used in the experiment: (**a**) system update, (**b**) gaming, (**c**) Facebook, (**d**) Youtube, (**e**) Netflix, and (**f**) Prime Video. Furthermore, the explainability of such models is poor as it is not obvious which features they selected. Hence, their internal workings are difficult to follow [24]. For example, in classification problems, each cluster is expected to have maximal homogeneity within the cluster and maximal heterogeneity between clusters. However, irrelevant or redundant features in the data will increase computational costs and may degrade the clustering accuracy. Therefore, selecting relevant features may alleviate such problems. We illustrate this issue in examples in Figure 4. According to Figure 4a,b, feature a and feature b alone are insufficient to distinguish clusters. Only the combination of these two features makes the clusters visible, as presented in Figure 4c. On the other hand, feature c, referred to as being irrelevant, lacks an effect on the clustering process (see Figure 4d). Thus, a relevant feature added to a feature subset may contribute to discovering unknown patterns in the data. Furthermore, different relevant feature subsets will generate different clusters. Therefore, multiple feature selection approaches exist to increase clustering performance by eliminating irrelevant and redundant features. Technically, a feature is a lower dimensional representation mapping, as follows:  
\[\phi:R^{w}\to R,\quad\phi(X_{i,w})=\phi([x_{i},\dots,x_{i+w}]), \tag{1}\]  
which calculates a specific property of the time series \(X=\{x_{1},x_{2},\dots,x_{i},\dots\}\). We used overlapping sliding windows, operating on traffic traces, to extract the features. The parameter \(w\) is the number of consecutive time points that will be included in each window. It can be interpreted as the length of the window. The window advances through the sequential values of the time series one time point at a time which is called the step size, as presented in Figure 5. As the window length is greater than its step size, the windows overlap. We processed the results from each window to generate the features, examples of which include the average, variance, the lowest/highest value etc. The features can be computed for different window lengths \(w\). In our work, we set \(w\) to 10, 20, and 40 s. The smallest window of 10 s is comparable with the window's size from [9], where the authors used 12 s to identify the traffic. The largest window is smaller than in [25], where the authors used window lengths set to 60 s and larger for their CNN, which requires a larger amount of data for its training. For feature extraction, we used tsfresh (FeatuRe Extraction based on Scalable Hypothesis tests) [26]. According to the [26], tsfresh calculates 794 time series features. Such a large number of features is unnecessary for training an ML model.