# NTARC: A Data Model for the Systematic Review of Network Traffic Analysis Research
## 8 Conclusions  
NTARC is a data model for storing relevant information related to network traffic research. We widely described NTARC structures and introduced the tools developed for its creation, validation, sharing, and deployment. NTARC databases are expected to grow with the curation of new and old published papers, whereas NTARC structures are expected to be progressively refined with usage. Overall, NTARC is devised to improve how science is done in the field, and this is achieved by enhancing how research material and information is reused.  
By using the \"NTARC Database\"--a release of NTARC objects containing the last years' principal field investigations--we reviewed the trends and characteristics of NTA research from a critical and systematic perspective. NTA is particularly focused on attack detection, anomaly detection, and traffic classification, and the standard profile for a research paper is the proposal of a method based on machine learning that claims to improve detection accuracy. However, as posed by [PERSON] and [PERSON] in [PERSON] and Paxon (1931), machine learning has been widely used for security and NTA research for the last few decades, but its presence in commercial and real-world solutions has been almost non-existent. This conclusion draws an incongruuous picture in which research and application seem to live in distant worlds.  
We also identified some undesired trends to avoid. Summarizing: (a) a lack of accurate descriptions of NTA problem spaces, (b) an insufficient discussion about the traffic classes aimed at, (c) obviating post-analysis, (d) inaccurate, vague, or undefined descriptions of aimed anomalies, (e) inappropriate, unrealistic data setups for unsupervised analysis, (e) the use of obsolete, irrelevant datasets, (f) monolithic approaches for too complex problems, (g) neglecting encryption and streaming characteristics, and (f) non-replicable experiments or non-public experimental resources.  
Such undesired traits are partially caused by the limited access to valuable network data by researchers (especially to labeled data), also due to a lack of realistic test environments and methods for evaluating new proposals. NTA is therefore tackled under laboratory conditions that do not properly consider the constraints, peculiarities, and limitations of final implementations and might not cover practical requirements in many cases. As a consequence, the relevance and efficacy of expert research is severely reduced.  
Conceptualization, F.I. and D.C.F.; data curation, F.I, D.C.F., G.V., and M.B.; formal analysis, F.I.; methodology, F.I.; project administration, T.Z.; software, D.C.F. and G.V.; supervision, T.Z.; validation, D.C.F. and G.V.; writing, original draft, F.I.; writing, review and editing, D.C.F., T.Z., G.V., and M.B. All authors have read and agreed to the published version of the manuscript.  
This work was partly supported by the project MALware cOmnunication in cRitical Infrastructures (MALORI), funded by the Austrian security research program KIRAS of the Federal Ministry for Transport,Innovation and Technology (BMVIT). The authors also acknowledge TU Wien University Library for financial support through its Open Access Funding Programme.  
The authors declare no conflict of interest.