## 3 Initial Data Processing: Avoiding Model Bias
### Organizing Traffic Flows  
To avoid any data leakage from packets in the same flow in training and test datasets, we propose a folder structure that allows having the packet images of the same flow in a common path. This will be useful for testing with independent inputs in the model. As shown in Figure 3, a folder structure with three levels was utilized. At the first level, all the folders with different traffic captures from the dataset are organized, totaling 42 groups of applications and services. Within these folders, at the second level, all flows that comprise the traffic capture are stored. This means that each capture can contain a varying number of flows, and each flow can have a different number of packets. At the third and final level, each flow is divided into 1D and 2D images. We did not consider higher-dimension images, as state-of-the-art images did not show substantial improvements. These images are stored in the respective folders and are used as input files for model training or testing. A problem with this system of grouping images by flows is that in some cases, such as File Transfer-type applications, there will be very few flows but with thousands of images each. However, in other cases we may have many small streams with few images. Our proposed solution limits how many packets are used per traffic flow, so that there are no large differences in the number of packets in each flow. Similarly, the work in [29] developed traffic classifiers with high accuracy percentages that used only the first 20 packets in each flow. However, this may introduce bias in the training, since connection closure will not be observed in all flows. Figure 4a illustrates the standard dataset division process as described in the reviewed literature. In this scenario, each packet from a traffic capture (represented as colored geometric shapes) is divided between train and test sets, either using a round-robin algorithm or randomly. This approach can lead to data leakage during model testing, as packets from flows used in training share information. Figure 4b depicts our proposed methodology, which includes grouping packets into flows to ensure no information is shared between the train and test splits. This prevents overfitting and results in a model that should perform more consistently with what is expected in a real network environment. Hereafter, we will refer to this phenomenon as 'flow dependence'. With these considerations, we can perform a desired data-leakage-free train-test split. Suppose we want to divide the dataset between 70% training files and 30% test files. In a first approach, the first 70% of the flows in the trace are assigned to the training dataset, and the last 30% are assigned to the test dataset. The advantage of this method is that it is easy to implement and debug. The main disadvantage is that the training flows will be the first of the capture and, in case there is a relationship among the flows, some overfitting would be introduced. An alternative is to perform a round-robin system between the flows. Figure 3: Proposed folder structure for traffic classification. In this way, the first seven flows would be for training, the next three for testing, then seven again for training, etc. This method corrects the possible overfitting introduced due to the order of the flows. The last proposal consists of randomly choosing 70% of the flows in the training set and 30% in the test set. This method is very difficult to debug and check for errors. On the other hand, there are no problems with the order of flows and their relation and overfitting. In summary, this section has detailed the process on how to avoid bias in the classification of encrypted traffic packets using convolutional networks. Our assumption was that the current literature and authors were not giving enough effort in the handling and preprocessing of the payload data. Now, with the given preliminary results, we have shown that overfitting and model bias might be common in the literature.