## 2 Related Works  
Traditional traffic classification schemes are based on payload-based classification or port-based classification. However, both methods have limitations. When it comes to encrypted traffic, payload classification is infeasible. Port-based methods can only classify data based on publicly known ports. Many applications, however, use dynamic ports; thus, the port-based method has become obsolete. Later, the deep packet inspection of network traffic packets addressed the shortcomings of the port-based approach. However, this method was not suitable for encrypted network traffic, which started to dominate the Internet. Therefore, new classification methods based on traffic statistics or applications' behaviour became popular. They focus on analysing traffic patterns rather than the traffic content. They can consider application flow features, such as throughput duration, mean, or variance. These features provide an insight into the nature of the traffic. Statistical methods and heuristics are often employed to extract these features for classification. In turn, to enable the classification itself, researchers employ ML algorithms, which can be divided into supervised and unsupervised categories. Every type of ML algorithm has a different effectiveness in the traffic classification process, with strengths and weaknesses. Supervised methods cluster traffic traces into pre-defined classes in the training and testing phases. Typically, researchers apply support vector machines (SVMs), naive Bayes (NB) or C4.5/5.0. The latter builds a decision tree by recursively dividing the dataset based on the attribute that offers the highest information gain, which indicates how effectively a specific attribute distinguishes the classes. For example, in [5], the authors used improved SVM to classify web, mail, and file transfer protocol (FTP) traffic. The algorithm dynamically adjusted the quadratic search area, reduced the density of quadratic mesh generation, and prevented over-fitting. The authors of [6] applied NB to identify distributed denial of service (DDoS) attacks in ad hoc networks based on abnormalities in traffic. In [7], the authors designed a monitoring system based on C5.0 and time-series analysis to detect traffic abnormalities for Internet of things (IoT) applications. In [8], the researchers developed a traffic classification method using deep learning and data fusion to identify encrypted traffic and distinguish between virtual private network (VPN) and non-VPN traffic. The authors pre-processed the data and applied a deep belief network, a convolutional neural network (CNN), and multi-layer perceptron. They combined the result with Bayesian decision fusion and achieved an average accuracy of 97%. In [9], the authors used a dataset of 200,000 titles to find differences in the sizes of neighbouring video segments, the HTTP header, and extra data created in the transport security layer. Their results show that, by continuously sniffing the encrypted video streaming for 12 s, the precision exceeded 98%, and the false positive rate was nearly 0. In [10], the authors identified videos from Facebook and Instagram transmitted with the support of the QUIC protocol. Using the fingerprint-matching method, the authors achieved accuracies exceeding 97% for the open-world and about 99% for the closed-world (prepared by the authors) dataset. In [11], the authors proposed a model working on two scales to classify encrypted traffic. The model included a convolutional byte layer that stored local features and a packet layer that stored global features. The packet layer was based on a bidirectional encoder. The model accuracy exceeded 99%. In [12], the authors suggested a video fingerprint matching method that obtainedaccurate results by sampling less than 10s of video playback. The method found DASH segments and was improved with a fingerprint storage structure that kept the matching time complexity at O(1), making it good for identifying traffic in real-time.