## 4 Results
The sliding window length was set to 10 s.  
clustering algorithms can leverage the varying distributions of the aforementioned features. Relying solely on a single characteristic for clustering is unlikely to yield optimal results. Therefore, for each clustering algorithm employed, we utilized three of the most significant features to enhance the effectiveness of the clustering process. The feature significance depends on the time window length. The length of the window influences the amount of historical data used when calculating features. A shorter window can capture more recent trends and fluctuations, while a longer window offers a broader perspective that includes seasonal patterns and long-term trends. Depending on the characteristics of the trace, different window lengths may generate features with different degrees of relevancy. In Table 2, we list the features applied for every window length. Table 3 presents the precision (2) and recall (3) values for different clustering algorithms and window lengths. Among the examined algorithms, OPTICS achieved the highest precision and recall, while KMeans gained the poorest results. With the increasing window length, the precision and recall increase. This can be explained by the fact that the longer the window is, the more data it contains. Hence, the generated features better represent the statistical characteristics of the data, which results in a better clustering performance. However, the differences in the results for individual algorithms are not significant and do not exceed 10%. The autoencoder ANN achieved a relatively low score, especially for shorter windows. This tool, like most deep ANNs, needs a significant amount of data to train therefore it should operate on longer windows. \begin{table}
\begin{tabular}{l c c c} \hline \hline  & \multicolumn{3}{c}{**Window Length**} \\
**Feature** & **10 s** & **20 s** & **40 s** \\ \hline The longest strike below the mean & o & x & x \\ The number of crossings & o & o & o \\ Sample entropy & o & o & x \\ Count below mean & x & o & x \\ Mean & x & x & o \\ Variance & x & x & o \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The features used for clustering for a given window length \(w\). The symbols o and x indicate that the feature was significant (o) or insignificant (x) for a given window length. Figure 7: Features histogram for window size set to 10 s. (**a**) The longest strike below the mean; (**b**) the number of mean crossings; (**c**) sample entropy. Clustering will exploit different temporal characteristics of the features for video and non-video traffic. In the next step, we looked at the individual traffic classes in more detail. Figure 8 presents the F1 score (4) for every traffic class, clustering algorithm, and window length separately. Similarly to the results presented in Table 3, in the majority of cases, autoencoder and KMeans had the lowest score. The best F1 score, in most cases, was achieved by OPTICS. It is likely that the groups may have different shapes, densities, sizes, or outliers, which negatively influence KMeans's performance. Again, it seems that the amount of data is insufficient for autoencoder. As expected from the results presented in Table 3, increasing the sliding window length positively impacts the clustering results. Finally, individual traffic classes produce mixed results. From the non-video traffic, the higher F1 score enabled the clustering of the traffic generated during multiple file downloads. As presented in Table 2 and Figure 6, the traffic generated by a system update had relatively high throughput and less variance, thereby saturating nearly all available network bandwidth. The traffic generated during the gaming and social media sessions was harder to identify. Both types of traffic shared similar basic statistics like mean or variance (see Table 3). Therefore, even the increase in window length does not significantly improve the F1 score. Thanks to a more diverse structure, video traffic clustering generated better results.