## 3 Methodology  
The methodology is divided in to several phases. In the first phase, we have created a formal mathematical model that explains the complete framework of VPN forensics, where each function represents a step in the process, from establishing a VPN connection to recording transactions on the blockchain, and finally analyzing the data with CNN and GNN for forensic reporting depicted in Listing 1. This model provides a structured approach to capturing, recording, and analyzing VPN traffic for forensic purposes. The mathematical model for our mobile VPN forensics framework integrates various components for a comprehensive analysis. Initially, VPN connections between two mobile devices are established and voice calls are routed through OpenVPN, represented by functions \(V_{\text{init}}\) and \(C_{\text{est}}\) as depicted in Figure 2. Data transfer during these calls is denoted as \(D_{\text{trans}}\). Throughout this process, critical forensic data are collected at various intersections, encapsulated in \(F_{\text{collect}}\). These data are then securely logged onto a blockchain through an API function \(B_{\text{api}}\), ensuring integrity and non-repudiation, and undergoes a consensus mechanism \(B_{\text{cons}}\). For in-depth analysis, these blockchain-recorded data are processed through a combination of Convolutional Neural Networks (CNNs) and Graph Neural Networks (GNNs), symbolized by \(f_{\text{CNN}}\) and \(f_{\text{GNN}}\). These networks classify and interpret the data, weighted by parameters \(\alpha\) and \(\beta\). The output of this analysis, \(Y\), is then synthesized into a comprehensive forensic report \(R\) by the function \(\mathcal{F}\). This model thus offers a robust approach to capturing, recording, and analyzing VPN traffic data for forensic purposes, leveraging the strengths of blockchain technology and advanced neural networks. The sequence diagram (cf. Figure 2) for the VPN forensics model outlines a process where two mobile devices communicate over a VPN, with the interaction being logged and analyzed for forensic purposes. Mobile Device A and Mobile Device B establish a VPN connection with the OpenVPN Server, each receiving a unique virtual IP address. These connection details, along with subsequent voice call data, are logged onto a blockchain, ensuring a secure and tamper-proof record. The sequence covers the initiation, execution, and termination of a voice call between the two devices, with each significant event--connection establishment, voice call setup, data transfer, and call termination--being recorded on the blockchain. These blockchain-stored data are then fed into a Convolutional Neural Network (CNN) model for forensic analysis. The CNN model classifies the data and identifies any anomalies or patterns of interest. This comprehensive approach integrates secure VPN communication, immutable logging with blockchain technology, and advanced data analysis using CNN, providing a robust framework for mobile VPN forensics. ```
1
2 VPNInitialization:
3
4 LetV_{init}(M_i,M_j)representthefunctiontoinitializeaVPNconnectionbetweenmobiledevicesM_iandM_j. 5
6 CallEstablishment:
7
8 ThefunctionC_{est}(M_i,M_j)representsestablishingavoiceallfromM_itoM_jviatheOpenVPNserver. 9
10 DataTransfer:
11
12 LetD_{trans}(M_i,M_j)denotethedatransfer(voicedata)betweenM_i$and$M_j. 13
14 ForensicDataCollection:
15
16 DefineF_{collect}(D_{trans})asthefunctionforcollectingforensicdataatvariouspointsduringD_{trans}. 17
18 BlockchainInterface:
19
20 LetB_{api}(F_{data})representtheAPIfunctionforrecordingaforensicdattransactionF_{data}totheblockchain. 21
22 ConsensusMechanism:
23
24 DefineB_{cons}(T)astheconsensusmechanismfunctionforablockchaintransactionT. 25
26 CNNandQNNProcessing:
27
28 Letf_{CNN}(X;\theta_{CNN})andf_{GNN}(G;\theta_{GNN})representtheCNNandQNNmodels,respectively,whereXistheinputdatafromblockchainandGisthegraphrepresentationofVPNtraffic. 29
20 CombinedAnalysis:
21Y=\alphaf_{CNN}(X;\theta_{CNN})+\betaf_{CNN}(G;\theta_{CNN}).