## 2 Related Work
### Comparative Analysis  
To comprehend the significance of traffic classification using convolutional networks, a thorough review of 20 articles published between 2017 and 2022 was conducted. Table 1 provides a summary of this state-of-the-art analysis, comparing our work with previous research. \begin{table}
\begin{tabular}{l l l l l l l} \hline \hline
**Paper** & **Year** & **Architecture** & **Dataset** & **Output** & **Online** & **No Flow Data Leakage** \\ \hline Ours. & 2024 & 1D-CNN, 2D-CNN & ISCX VPN & Services & ✓ & ✓ \\
[18] & 2023 & CIL CNN & MIRAGE19 & Mobile apps & \(\times\) &? \\
[19] & 2022 & CNN & ISCX nonVPN & Services & \(\times\) & \(\times\) \\
[20] & 2022 & Decision Tree & ISCX VPN and nonVPN & Heartbleed attacks & ✓ &? \\
[21] & 2022 & 1D-CNN & MIRAGE COVID CCMA 2022 & Mobile apps & \(\times\) & ✓ \\
[22] & 2022 & 1D-CNN, DBN & ISCX VPN and nonVPN & VPN vs. nonVPN and & ✓ & \(\times\) \\  & & & Services & & & \\
[23] & 2022 & FDCNN & ISCX VPN and nonVPN & VPN vs. nonVPN and & ✓ & \(\times\) \\  & & & Services & & & \\
[12] & 2021 & 2D-CNN & ISCX nonVPN & Applications & ✓ &? \\
[17] & 2021 & 2D-CNN & ISCX VPN and nonVPN & Both & \(\times\) &? \\
[24] & 2021 & GADCN & USTC TFC2016 & Applications & \(\times\) &? \\
[10] & 2020 & 1D-CNN+SNE & Own & Services & \(\times\) &? \\
[25] & 2020 & SAE \& 1D-CNN & ISCX VPN and nonVPN & Applications & ✓ &? \\
[26] & 2020 & CNN, LSTM, SAE, & WIDE, USTC & Applications & \(\times\) &? \\
[27] & 2019 & 1D-CNN & ISCX VPN and nonVPN, ISCX & Services and Malware & \(\times\) &? \\  & & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Review of recent publications on traffic classification. ‘Online’ column identifies if the works process network traffic on the fly (‘\(\checkmark\)’) or not (‘\(\times\)’). ‘No Flow Data Leakage’ column identifies if the handling of bias and data leakage is adequate (‘\(\checkmark\)’) or not (‘\(\times\)’), or if it is unknown due to lack of information in the paper (‘?’). This literature review is focused on several key aspects of network traffic classification, including the classification of services or applications and if the traffic was encrypted, the dataset analyzed, the network architecture utilized, and whether packet processing was conducted on the fly or by waiting to generate flow statistics. Additionally, this review assesses how protocol headers were handled and how packets that did not meet the minimum size of the neural network input were padded. The analysis also examines whether the reviewed articles aimed to reduce bias by class balancing and manage data leakage by separating training streams from testing streams. In the comparative analysis, we studied the authors' handling of bias and data leakage. We observed that several studies report highly accurate performances on testing datasets, with some achieving as high as 99%. However, a significant proportion of these studies lack a detailed description of the experimental protocol and dataset handling process, raising concerns regarding possible flow bias or data leakage. Except for us and the work in [21], the rest of studies cited in Table 1 either do not specify how the train-test split was conducted (?) or give hints that data leakage might have happened ('\(\times\)'). Additionally, in many cases, it is not clear how the packet-to-image conversion was performed, with no information provided on whether headers were eliminated or if images were padded to obtain the desired dimensions. Moreover, we note that some studies suffer from imbalanced classes or omit this information altogether. Finally, the use of flow statistics instead of independent packets presents a challenge for real-time traffic classification in actual networks, as on-the-fly processing is required. In the articles we reviewed, a wide variety of open datasets were utilized. ISCX VPN-nonVPN [33] is the main one for traffic classification, used by [17; 19; 20; 21; 22; 28; 31]. Other ones are ISCX 2012 IDS [34], USTC-TFC2016 [31], MIRAGE19 [18], and MIRAGE-COVID-CCMA-2022 [21].