# Explainable Internet Traffic Classification
## 4 Experimental Results
### Comparison among the Different Classification Models
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline  & & \multicolumn{2}{c}{**First**} & \multicolumn{2}{c}{**Median**} & \multicolumn{2}{c}{**Last**} \\
**Feature** & **Class** & **TPR** & **FPR** & **TPR** & **FPR** & **TPR** & **FPR** \\ \hline \multirow{6}{*}{Statistical} & SSHD & 0.948 & 0.004 & 0.941 & 0.005 & 0.813 & 0.014 \\  & XRDP & 0.883 & 0.003 & 0.885 & 0.003 & 0.531 & 0.014 \\  & DNSMasq & 0.969 & 0.001 & 0.961 & 0.001 & 0.694 & 0.005 \\  & Chrome & 0.933 & 0.003 & 0.894 & 0.005 & 0.510 & 0.021 \\  & Firefox & 0.201 & 0.015 & 0.203 & 0.014 & 0.156 & 0.015 \\  & Amule & 0.871 & 0.003 & 0.835 & 0.004 & 0.567 & 0.010 \\ \hline \multirow{6}{*}{Composite (\(H=3\))} & SSHD & 0.950 & 0.004 & 0.952 & 0.003 & 0.945 & 0.004 \\  & XRDP & 0.592 & 0.011 & 0.582 & 0.011 & 0.524 & 0.012 \\  & DNSMasq & 0.853 & 0.004 & 0.845 & 0.004 & 0.752 & 0.006 \\  & Chrome & 0.101 & 0.033 & 0.089 & 0.033 & 0.015 & 0.036 \\  & Firefox & 0.000 & 0.015 & 0.000 & 0.015 & 0.002 & 0.015 \\  & Amule & 0.917 & 0.003 & 0.903 & 0.004 & 0.854 & 0.006 \\ \hline \multirow{6}{*}{Composite (\(H=5\))} & SSHD & 0.972 & 0.002 & 0.973 & 0.002 & 0.896 & 0.008 \\  & XRDP & 0.636 & 0.011 & 0.646 & 0.010 & 0.432 & 0.016 \\  & DNSMasq & 0.930 & 0.001 & 0.906 & 0.002 & 0.371 & 0.010 \\  & Chrome & 0.943 & 0.003 & 0.877 & 0.005 & 0.534 & 0.020 \\  & Firefox & 0.033 & 0.017 & 0.000 & 0.018 & 0.022 & 0.018 \\  & Amule & 0.848 & 0.003 & 0.835 & 0.004 & 0.600 & 0.009 \\ \hline \multirow{6}{*}{Composite (\(H=10\))} & SSHD & 0.972 & 0.003 & 0.972 & 0.003 & 0.871 & 0.012 \\  & XRDP & 0.887 & 0.004 & 0.881 & 0.004 & 0.495 & 0.017 \\  & DNSMasq & 0.970 & 0.000 & 0.949 & 0.000 & 0.556 & 0.003 \\  & Chrome & 0.954 & 0.002 & 0.947 & 0.002 & 0.562 & 0.019 \\  & Firefox & 0.113 & 0.012 & 0.091 & 0.012 & 0.086 & 0.012 \\  & Amule & 0.809 & 0.003 & 0.773 & 0.003 & 0.389 & 0.009 \\ \hline \hline \end{tabular}
\end{table} 
Table 17: Proposed method: confusion matrix (UniBS, statistical). \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **SSHD** & **XRDP** & **DNSMasq** & **Chrome** & **Firefox** & **Amule** \\ \hline
**SSHD** & **1449** & 91 & 0 & 8 & 0 & 0 \\
**XRDP** & 3 & **581** & 0 & 40 & 0 & 1 \\
**DNSMasq** & 0 & 0 & **342** & 1 & 0 & 8 \\
**Chrome** & 24 & 2 & 0 & **887** & 3 & 0 \\
**Firefox** & 11 & 0 & 01 & 256 & **106** & 0 \\
**Amule** & 15 & 8 & 1 & 39 & 0 & **395** \\ \hline \hline \end{tabular}
\end{table} 
Table 18: Proposed method: confusion matrix (UPC, statistical). Nonetheless, as already discussed, our method is characterized by a high level of explainability. To quantify such an aspect, in Table 20 we report the complexity of our method (in terms of number of rules and TRL) and of the C4.5 algorithm (in terms of number of leaves and tree dimension). Note that we do not take into consideration SVM in this analysis, as it is well known that SVM must be considered as a \"black box\". As it can be observed from the table, the higher accuracy of C4.5 is paid with a much higher complexity, which directly results in a lower explainability. Note that as far as complexity is concerned, that for our proposed method we have considered the \"First\" case, which has a much higher complexity, but an only slightly better accuracy, with respect to the \"Median\" case. Therefore, out method results even more convenient, considering the \"Median\" case. To further clarify the level of explainability of the proposed method, we finally analyze some examples of classification rules (created for the UniBS data-set). In Figure 3, we show a generic strong fuzzy partition that has been used for each variable in the experiment. The fuzzy partition consists of seven fuzzy sets, labeled with linguistic values ranging from Very Low (VL) to Very High (VH).