## 2 Related Works
In [13], the authors proposed a real-time identification method for DASH-encrypted video traffic with distortion, named Zenith. The authors extracted fingerprints of video segment sequences to calculate resolution changes. Simulating the video sequence matching problem as a natural language problem, they proposed a traffic language model, which addressed video data loss, retransmission, and a frequency dictionary. The so-called response time distribution method, used to extract the response time of the server and client, was proposed in [14]. According to the authors, the response time remained relatively stable, thus allowing for the application of the proposed method in different network environments. The repose time was analysed and classified using the tree model. The approach was tested on several open, real-world traffic datasets in miscellaneous network scenarios. The above-supervised methods achieve the best score in traffic classification compared to unsupervised ML; however, they necessitate a substantial amount of labelled data for training. Acquiring and labelling this data can be time-consuming, costly, and labour-intensive. The performance of the model heavily depends on the quality of the labels. Incorrect or inconsistent labelling will lead to poor model performance. Hence, some research focuses on clustering. Clustering algorithms group similar data points together based on certain features or attributes. In the case of network traffic, these features might include packet size, inter-arrival time, and protocol information. By grouping similar traffic, it is possible to create distinct traffic categories, such as email, file sharing, or video streaming. Unlike supervised learning, unsupervised learning does not require labelled datasets; therefore, it can find hidden or unknown patterns in input data. However, clustering needs a similarity measure to distinguish and group data, which may be challenging. Due to its results being worse than those of the supervised approach, clustering is used less often in the literature that concerns network trace identification. Below, we give an overview of the recent works in this field. The authors of [15] exploited the DASH traffic pattern-related features and the K-nearest neighbours algorithm. They obtained recall, precision, and F1 scores of above 97% for a range of video content and encoding qualities. In [16], the authors proposed a clustering method based on Levenshtein distance for the title analysis of encrypted video traffic. The authors exploited characteristics of DASH traffic, which are different from non-video traffic. The accuracy of this solution was more than 95%. The authors of [17] identified different traffic classes in the fifth generation (5G) network. For this purpose, from connection traces in the radio interface, they extracted traffic descriptors such as uplink/downlink traffic volume ratio, activity, and session throughput. According to the authors, such a selection of descriptors made the solution network independent. The classification was based on agglomerative hierarchical clustering. In [18], the authors created an explainable identification process based on the so-called sufficient input subset (SIS) model to extract the features needed to classify traffic with a certain probability threshold. The generated SIS of each input sample was clustered using Density-based spatial clustering of applications with noise (DBSCAN), K-Means, and cosine-based hierarchical clustering. Over the last few years, the natural language processing (NLP) approach has been gaining popularity. [PERSON] et al. in [19] applied NLP to the clustering of encrypted videos without a priori knowledge of the video titles. They utilized a single clustering approach based on a framework derived from the statistical analysis of video traffic metadata. The features within the clustering process were manually selected; thus, the solution lacked automation.