## 2 Related Work
### Comparative Analysis
However, some examples of lab-created traffic and private datasets captured in different regions were observed [10; 26; 29; 30]. The aforementioned datasets contain network capture in the form of \(\,\text{pcap}\,\) files, where the label of the transmitted application or service is indicated in the title. Among these datasets, ICSX VPN-nonVPN [33] is consistently the most utilized, as it is the largest and has a wide variety of services and applications. It was selected as a benchmark dataset in articles aiming to provide comparisons between their results and the rest of the research community. Most of the time, the convolutional network architecture was complemented by another type of ML technique or DL methodology. Some examples we identified are tSNE (t-distributed Stochastic Neighbor Embedding) [10], k-NN (K-Nearest Neighbor) [33], SAE (Sparse Autoencoder) [25], RNN (Recurrent Neural Network) [26], GADCN (Generative Adversarial Deep Convolutional Network) [24], FDCNN (Frequency Domain CNN) [23], CIL (Class Incremental Learning) [18], decision tree [20], DBN (Deep Belief Network) [22], and Bayesian fusion [17]. Some of the studied articles, such as [17; 18; 19], utilize convolutional neural networks to extract information from statistics generated with various packets in the same flow. In some cases, these statistics are used to generate images, while in other cases, classic machine learning algorithms are utilized for classifying, which are excluded in the study conducted here, due to fundamental differences with the explainability of CNN classification. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Paper** & **Year** & **Architecture** & **Dataset** & **Output** & **Online** & **No Flow Data Leakage** \\ \hline
[28] & 2019 & 1D-CNN, 2D-CNN, 3D-CNN & ISCX VPN and nonVPN & Applications & ✓ & \(\times\) \\
3D-CNN & & & Own (RedIRIS) & Services & \(\times\) &? \\
[30] & 2017 & CNN & NOCSET, MOORESET & Applications & \(\times\) &? \\
[31] & 2017 & 2D-CNN & USTC TFC2016 & Malware & ✓ &? \\
[32] & 2017 & 1D-CNN & ISCX VPN and nonVPN & VPN vs. nonVPN and Services & ✓ &? \\
[33] & 2016 & k-NN & Own (VPN) & Applications & \(\times\) &? \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._In other studies on traffic classification with machine learning, it has proven to be an effective method for classification, but it also has several disadvantages. The first challenge is the difficulty of classifying the first packets in the session, which cannot be classified due to the lack of statistics. In some studies, this is resolved by waiting for the first five packets to generate the necessary inputs. Another problem introduced is the increase in packet latency due to classification, as the classifier must wait for the arrival of the first packets. Finally, computational and memory costs are added because real-time data structures that allow for the indexing of aggregated packet data must be generated, which can be a real challenge in a network at 10 Gbit/s or higher rates. To solve these problems in a real high-rate network, classification systems that work on the fly must be sought. Mainly, packet information should be used without seeking correlation with the information of its network flow. One way to perform this is to convert the packet into an image and process it with the convolutional network, as, for example, in [31; 32].