# Explainable Internet Traffic Classification
## 4 Experimental Results
### C4.5 Decision Tree  
The C4.5 decision tree has been taken into consideration because of the partly explainability of the results. Indeed, depending on the dimension of the tree and on the number of leaves, the classification results can be accompanied by an analysis of the criteria that take to a given decision. In this work, we have used the J48 classifier available in WEKA toolkit. As regards the parameters of the decision tree, we used the default parameters suggested in WEKA. In particular, the pruning of the decision tree is activated with a confidence parameter value of 0.25. In addition, the minimum number of instances per leaf is set equal to 2. Similarly to the UniBS case, Table 8 shows the achieved overall performance, while Tables 9 and 10 report the results in terms of \(TPR\) and \(FPR\) for each class of the UniBS and UPC data sets, respectively. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Feature** & **Class** & **TPR** & **FPR** \\ \hline \multirow{4}{*}{Statistical} & SSHD & 0.93 & 0.297 \\  & XRDP & 0.64 & 0.66 \\  & DNSMasq & 0.95 & 0 \\  & Chrome & 0.54 & 0.05 \\  & Firefox & 0 & 0 \\  & Amule & 0.79 & 0.004 \\ \hline \multirow{4}{*}{Composite (\(H=3\))} & SSHD & 1 & 0.63 \\  & XRDP & 0 & 0 \\  & DNSMasq & 0.78 & 0.004 \\  & Chrome & 0 & 0 \\  & Firefox & 0 & 0 \\  & Amule & 0.72 & 0.028 \\ \hline \multirow{4}{*}{Composite (\(H=5\))} & SSHD & 0.99 & 0.11 \\  & XRDP & 0.95 & 0.1 \\ \cline{1-1}  & DNSMasq & 0.89 & 0 \\ \cline{1-1}  & Chrome & 0.74 & 0.007 \\ \cline{1-1}  & Firefox & 0 & 0 \\ \cline{1-1}  & Amule & 0.46 & 0.001 \\ \hline \multirow{4}{*}{Composite (\(H=10\))} & SSHD & 0.97 & 0.01 \\ \cline{1-1}  & XRDP & 0.97 & 0.01 \\ \cline{1-1}  & DNSMasq & 0.99 & 0 \\ \cline{1-1}  & Chrome & 0.98 & 0.008 \\ \cline{1-1}  & Firefox & 0.001 & 0 \\ \cline{1-1}  & Amule & 0.76 & 0.01 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: SVM: TPR and FPR over UPC data set. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & **Mail** & **Skype** & **Firefox** & **Safari** & **BitTorrent** & **Amule** \\ \hline
**Mail** & **4174** & 0 & 0 & 411 & 0 & 36 \\
**Skype** & 31 & **1351** & 0 & 110 & 40 & 880 \\
**Firefox** & 0 & 6 & **865** & 5 & 0 & 25 \\
**Safari** & 964 & 0 & 0 & **11,778** & 1 & 435 \\
**BitTorrent** & 0 & 68 & 2 & 0 & **1685** & 6 \\
**Amule** & 82 & 55 & 34 & 314 & 7 & **4710** \\ \hline \hline \end{tabular}
\end{table} 
Table 7: SVM: confusion matrix (UniBS, composite—\(H=10\)). Note that in this case, the best accuracy is obtained in both cases with the statistical features (\(ACC=0.981\) over the UPC data set and \(ACC=0.969\) over the UniBS data set). Furthermore, differently from the SVM case, we can notice that the C4.5 does not present any critical result in terms of almost always unrecognized classes. For allowing a deeper analysis of the achieved results, in Table 11 we report the confusion matrix for the UPC data set and statistical features. Note that the C4.5 offers almost optimal results over all the classes in this case. Indeed, the only misclassifications occur with the most similar classes, that is when considering Chrome and Firefox. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Data-Set** & **Features** & **Accuracy** \\ \hline \multirow{4}{*}{UniBS} & Statistical & **0.969** \\  & Composite (\(H=3\)) & 0.82 \\  & Composite (\(H=5\)) & 0.86 \\  & Composite (\(H=10\)) & 0.961 \\ \hline \multirow{4}{*}{UPC} & Statistical & **0.981** \\  & Composite (\(H=3\)) & 0.867 \\  & Composite (\(H=5\)) & 0.964 \\  & Composite (\(H=10\)) & 0.966 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Performance achieved by the C4.5 classifier.