## 3 Methodology
In order to create organized data, we first parsed the unstructured PCAP or flow records from the combined dataset (ISCXVPN2016 and custom VPN traffic data). Python is used along with Wireshark and Scapy to complete this. We need to remove extraneous information that could not be helpful for the classification process before turning the structured data into photos. This entails eliminating unnecessary background traffic and only keeping application-specific traffic that is pertinent. To input the network traffic data into a CNN, we will convert the filtered structured data into images using nPrint, a network traffic fingerprinting tool. nPrint captures packet-level information and represents it as a one-dimensional binary string, capturing the presence or absence of specific features in each packet. These binary strings can then be converted into two-dimensional images, which can be fed as input into the CNN model. The 2D grayscale images are forwarded to the CNN as an input where it is passed through multiple layers of the CNN, where early layers in the CNN typically capture low-level features, while deeper layers capture higher-level, more abstract features such as specific traffic patterns or behaviors. The learned features are automatically determined by the CNN during the training process. Based on specific VPN protocols or applications, we associated each image with the appropriate label based on the application type, using the metadata provided with the dataset(depicted c.f Figure 3). Since the features in the images may have different scales, we have normalized the data to ensure that all features have equal importance during the model training process. This was achieved using min-max scaling and standardization techniques. In addition, to ensure that all classes are equally represented in training, validation, and testing sets, we split the data into separate training and validation sets as well as a testing set in order to evaluate the model's performance on unseen data and prevent overfitting. For the data preprocessing of the GNN model, T-Shark and batch scripting were used to convert PCAPs into csv files where we extracted 70 features. These data were then represented as graphs, where nodes represented network entities source and destination port numbers, and edges represented relationships between these entities such as communication links. We created the train and test split for the GNN in the same way as for CNN which is 80% for training and 20% for testing. ### Algorithms Used

#### 3.3.1 Convolutional Neural Networks (CNNs)

The CNN algorithm is a type of deep learning algorithm that takes advantage of the hierarchical nature of the data to build more complex patterns from simpler and smaller patterns that are previously compiled into a single pattern [32]. It is therefore possible for them to take in an image as input and assign importance based on learnable weights and biased to different aspects within that image in order to differentiate between them. In comparison to other classification algorithms, a CNN requires a much smaller amount of pre-processing than those used in other algorithms. Compared to primitive methods in which filters are hand-engineered, CNNs can learn these filters and characteristics with enough training, as opposed to primitive methods where filters are hand-engineered. In terms of its architecture, CNNs have been inspired by the organization of neurons in the human brain, which is analogous to the connectivity pattern of neurons in the human brain. The receptive fields of these artificial networks are made up of layers of artificial neurons called nodes, which are responsible for processing small portions of the input image. The idea of using smaller, local receptive fields leads to the concept of local receptive fields and two key properties of CNNs, which are sparse connectivity, or sparse weights, and Shared weights.