## 6 Results
### Understanding the Decision  
After studying the data and the model, we can explore the classification results using XAI techniques. In this section, we use GradCAM relevance for the different classes of the dataset to analyze the feature extraction procedure of CNNs in encrypted packets. After understanding the features, we provide a simplified ML model that achieves a similar performance with much less complexity.  
First, the relevance per sample is computed and displayed on the left-hand side of Figure 13. All of them but Figure 13g display similar behavior: they are smooth functions with some random noise. In order to model this, we provide a median function to act as the centroid of the groups that, by nature, should be less noisy. The right-hand side of the figure represents the same median behavior as representative of the relevance of each byte together with the histogram of packet lengths.  
Figure 11: Two-dimensional histograms of the relevance obtained with GradCAM-2D for two classes.  
Figure 12: Difference between the use of 1-pixel padding vs. 2 pixels or more in GradCAM.  
Figure 13a shows the relevance \(L^{c}\) and counterfactual relevance \(L^{c}\) according to GradCAM for class Chat. In general, \(\bar{L}^{c}\) is always above \(L^{c}\) except for an environment centered at 300 bytes, where \(L^{c}\) increases and surpasses \(L^{c}\). As shown in Figure 1, packets in this class have different sizes, and their images are filled with zeroes depending on such sizes. Thus, when looking at Figure 13b, we observe that this point is not random, but the mode of the packet length. This means that the model is mostly focusing on the last bytes of content in the packet. Due to the convolutional nature of the CNNs, they are powerful  
Figure 13: Relevance and counterfactual relevance compared to packet length per class.  
when detecting borders (abrupt changes from high values to low values), so in particular, it is likely that the convolutional model is just extracting the feature that the packet is ending at around 300 bytes. Bear in mind that we used zero padding to fill the packet images, so the CNN was able to detect this abrupt change to a zero-valued region at the end of each packet.  
Similarly, Figure 13c exposes the relevance and counterfactual relevance of class Audio, where the same behavior occurred at around 100 bytes. This is confirmed by Figure 13d, with a mode of the packet length at around 100 bytes.  
For class E-mail, the result is not exactly the same. In this case, the relevance \(L^{c}\) of Figure 13e is always above \(L^{c}\) except for a small interval centered at 100 bytes. In this case, by looking at the histogram in Figure 13f, \(L^{c}\) highlights that values around 100 bytes of packet size are not likely for class E-mail.  
Figure 13g shows the hardest-to-categorize behavior of all classes, class FTP. Due to the spread value of the packet sizes, the models showing values of \(L^{c}\) spread around all values, with an important maximum only at 1024 bytes. In particular, this maximum is confirmed with the mode of the packet size in Figure 13h. This confirms the poor performance of this class observed in the confusion matrix (Figure 8), due to the overlapping of the packet length histograms among the classes.  
Class Video in Figure 13i exhibits a multi-modal relevance behavior with modes around 50, 125, and 1024 bytes. For the rest of the values, \(L^{c}\) is equal to \(L^{c}\). In the histogram of Figure 13j, we confirm yet another time the hypothesis of the packet size being the most relevant attribute in encrypted traffic classification.  
These results allow us to conclude that CNNs are overcomplicated models to classify high-entropy payloads that only provide information on the size of the payload. With this in mind, our next step is to provide a simpler model that only uses the packet size to check whether a similar performance can be achieved with a higher packet classification rate in packets/s.  
For this reason, we built a