## 3 Methodology
This CNN training process can be represented by the following equation:

\[\text{loss}=\frac{1}{N}\sum_{i=1}^{N}(Y_{i}-\hat{Y}_{i})^{2} \tag{1}\]

where \(Y\) represents the actual label, \(\hat{Y}\) is the predicted label, and \(N\) denotes the number of observations. Figure 3: A complete process of CNN while training the dataset and finally the prediction. The goal is to minimize the loss function using optimization algorithms like stochastic gradient descent or Adam optimizer. The process is iteratively repeated until the model's predictions closely match the actual values, thereby minimizing the loss function [18]. #### 3.3.2 Graph Neural Networks (GNN)

In the context of machine learning, Graph Neural Networks (GNNs) are a powerful tool to extract features from a graph by iteratively aggregating the features that are shared by neighboring nodes in the graph. The neighborhood aggregation method used by GNNs continuously aggregates a node's neighbors in the network based on their features [19]. More formally, the feature vector of node \(i\) in the \(l\)-th layer

\((H^{l}[i])\) is computed as follows:

\[H^{(l)}[i]=\sigma\left(\sum_{j\in N(i)}D_{ij}^{-1}A_{ij}W^{(l)}H^{(l-1)}[j]\right) \tag{2}\]

where

* \(N(i)\) is the neighborhood of node \(i\);
* \(A_{ij}\) is the adjacency matrix;
* \(D\) is the degree matrix;
* \(W^{(l)}\) at the \(l\)-th layer is the weight matrix;
* \(H^{(l-1)}[j]\) is the node \(j\) feature vector at the \((l-1)\) layer;
* \(\sigma\) refers to the activation function. While the feature vectors \(H^{l}\) are steadily updated, the weights \(W^{(l)}\) are learned during training by gradient descent, backpropagation, or other optimization techniques like Adam. Each layer of the GNN undergoes the same procedures many times. This method enables GNNs to simultaneously capture the node attributes and graph structure, which is especially advantageous for tasks involving graph classification, node classification, and link prediction. ## 4 Implementation

The provided Python code illustrates a streamlined approach for retrieving VPN forensics data from a blockchain (specifically Hyperledger Fabric) and analyzing it using a Convolutional Neural Network (CNN) (Listing 2). In selecting Hyperledger Fabric for our blockchain-based VPN traffic classification and forensic analysis framework, we were guided by its distinctive advantages that align closely with our needs. Hyperledger Fabric's modular architecture enables tailored blockchain solutions, crucial for integrating sophisticated forensic tools effectively. Its support for private channels and data collections ensures the privacy and confidentiality necessary for handling sensitive VPN data. The platform's high performance and scalability are essential for managing the substantial data volumes in forensic applications, while its permissioned nature allows precise control over network access, enhancing data integrity and security. Additionally, Fabric's support for chaincodes in various programming languages facilitates the direct implementation of complex analysis algorithms. Rich query capabilities and customizable endorsement policies further empower our forensic analysis, ensuring our platform not only meets the high computational demands but also adheres to rigorous security and privacy standards critical in legal and forensic contexts.