## 4 Results  
The tsfresh software, version 0.20.2, computed 748 features, from which 149 features were labelled as weakly significant and 104 as strongly significant. The rest of the features were marked as insignificant. In the further analysis, we excluded the insignificant and weakly significant features. From the list of strongly significant features, we selected the six most significant features, depending on the sliding window length. The features are as follows:  
* The longest strike below the mean--returns the length of the longest consecutive subsequence \(l\) in vector \(X\) that is bigger than the mean \(\mu\  
In Figure 6, we present the three most significant features for non-video and video traffic, namely the longest strike below the mean, the number of the mean crossings, and sample entropy. We set the length of the sliding window to 10 s. Hence, these features should be the best statistical description of the non-video and video traffic classes. Regarding the longest strike below the mean, we can observe that its value is usually lower for non-video than video traffic; see Figure 6a. The number of the mean crossings for video traffic (see Figure 6b) has more regularity and oscillates mostly in a limited range than non-video traffic. For non-video traffic, the feature values have more variability and have no clear patterns. The last considered feature, sample entropy, has generally lower values for video than for non-video traffic; see Figure 6c. Also, for video traffic, we can identify periodic behaviour in the chart, which is missing for non-video traffic. The transient characteristics presented in Figure 6 show only a certain indication of the statistical features of the original time series. Due to their fragmentary nature, it is impossible to draw far-reaching conclusions based on them. Therefore, to better illustrate the characteristics of the features considered, in Figure 7, we present their histograms. Similarly to Figure 6, we consider the same three features, with the sliding window length set again to 10 s. We generated the histograms for the whole duration of the traces. In the case of the longest strike below the mean, we can observe that its values are statistically larger for the video compared to other examined types of traffic (Figure 7a). The explanation for this is the behaviour of DASH algorithms, which try to avoid frequent switches of video bit rate; consequently, their traffic has less oscillation around the average for video traffic. The number of the crossing feature shows significantly lower values for video traffic, which rarely drops its bit rate below the specified threshold (Figure 7b). The exception is throughput decreases resulting from the ON/OFF pattern. However, it has a lower frequency than non-video traffic oscillations, so its impact on the feature is limited. The bit rate of the non-video traffic often drops to low values, or the transmission stops completely. This is due to the continuity of video traffic; i.e., users do not stop and restart video streaming too often, with the exception being Netflix, due to its short ON and long OFF periods (see Figure 3e). In the non-video traffic, we see more breaks: for instance, during gaming, a user can wait for an event to happen; during Facebook browsing, a user may read a text; during a system update, the computer may verify a downloaded file before proceeding to download the next one. Finally, the sample entropy presented in Figure 7c is higher for the non-video traffic. As mentioned earlier, the video traffic is more stable, and users make fewer breaks during transmission. Therefore, it has lower entropy, which means it is more predictable than non-video traffic with higher entropy. Consequently,  
Figure 6: The most significant features for the non-video and video traffic traces: (**a**) the longest strike below the mean, (**b**) the number of mean crossings, and (**c**) sample entropy.