## 4 Results
### Discussion  
The research results indicate that utilizing the three most important features enables us to differentiate between video and non-video traffic. As the sliding window length increases, the significance of these features evolves. However, this change does not impact the workflow, as feature selection occurs automatically without manual intervention. Generally, features derived from longer sliding windows demonstrate improved precision, recall, and F1 scores in distinguishing traffic compared to those from shorter windows. This improvement is due to the larger volume of data available as the window expands. On the other hand, longer windows require more computational resources for the algorithm to identify the flow. Also, deep learning techniques, like the employed for comparison purposes autoencoder, may gain better results here. Therefore, the optimal solution should achieve a high-performance score while maintaining a relatively short processing time.  
There are several points where our workflow could have been improved in order to generate better results. From multiple feature filtering algorithms [31], we selected only one. Potentially, the wrapper or embedded methods mentioned in Section 3.2 could have produced better results. As we may notice, some of the features may be correlated. For example, with increasing values of the feature the longest strike below the mean, the values of the number of the mean crossing usually decrease. However, there is no correlation if the mean crossings happen at the ends of the vector \(X\) (1) and not in the middle. Filtering algorithms tend to include correlated features in their shortlist [32]. Hence, there is a need for research on better feature-filtering algorithms which can exploit such nuances.  
Secondly, we selected well-known classical clustering algorithms. Will the results improve when applying more advanced methods based on ANN? Currently, there are many deep artificial neural network architectures used for general preprocessing data or for clustering it, such as autoencoders, CNN, and graph neural networks [33; 34], as well as dedicated to feature engineering [35; 36; 37]. These techniques achieve impressive results, but compared to our solution, they require more training data, are more computationally expensive, and lack transparency and explainability. However, ANNs, supported by explainable feature engineering and selection, can produce even better results [2; 3]. At the same time, feature selection embedded into ANNs may give poorer results [38].  
Thirdly, what is the optimal number of features to generate the best clustering? In our work, we used three features; however, a larger number could have increased the F1 score. Nevertheless, too many features can impede the clustering performance because of the so-called curse of dimensionality. For example, in high-dimensional spaces, data points will become more sparse, and, consequently, the distances among them will be less meaningful, which can negatively impact clustering. The number of features needed depends on the nature of the data and the clustering algorithm used. However, to our knowledge, no algorithms currently determine the optimal number of features for a specific clustering scenario. The researchers propose to compute these parameters using trial and error [38; 39].  
The traffic was captured in a stable environment; however, real network conditions are not as ideal as a controlled dataset. Typically, a real network environment combines wired and wireless networks where 3G, 4G, and 5G coexist. Alongside varying network standards, the bandwidth of these networks also differs. Each network environment presents unique delays and jitter. These factors can impact the aforementioned characteristics, which significantly diminishes the effectiveness of the methods when applied to unknown heterogeneous networks.