## 1 Introduction  
Protecting sensitive data from threats has become more crucial now for both the individuals and enterprises than the few previous decades with the growing expansion of Internet uses. In this respect, a Virtual Private Network (VPN) works well for offering secure and private communication over public networks which has increased its popularity within the field of the information technology (IT) industry. Through providing a robust solution by this VPN, the data traffic is encrypted, confidentiality is ensured, and the users are allowed to make a secure connection to a remote network. It is therefore justifiable to exaggerate the significance of VPNs in the IT landscape because it plays a crucial role in protecting sensitive information particularly required in places where corporate networks are accessed by the users or there is a connection to public WiFi, which are considered as potentially insecure networks. To protect data from the unauthorized access and interception, an encrypted tunnel is formed between the VPN server and the user's device to connect them both. They are therefore essential for companies, governmental agencies, and private users who are concerned with their online privacy and security. As cybersecurity continues to evolve, stringent Internet regulations introduced by some countries, such as recent bans on VPNs and hefty penalties for their use, highlight the pressing need for more sophisticated methods to monitor and analyze VPN traffic. These countries have enforced laws making VPN use on phones illegal, accompanied by severe fines and potential imprisonment. Such measures underscore the increasing focus on VPN usage globally, particularly when they are employed to circumvent geo-restrictions and access blocked content, raising significant issues regarding cybersecurity and national security [1; 2; 3]. Furthermore, national telecommunications regulatory authorities have enforced restrictions on numerous websites for various reasons. These reasons often include hosting content that conflicts with government policies or promotes perspectives contrary to national values, among other issues. Such widespread censorship efforts highlight the inherent challenges and complexities of managing Internet usage. These measures illustrate the ongoing struggle to balance digital content management with the need to uphold societal norms, while also preserving free access to information. The continued regulation of online spaces brings into focus the ongoing tension between safeguarding national security and protecting individual rights to information access. As far the operation of VPN is concerned, it is essential to explore its workings and the different types of protocols it employs in order to thoroughly understand the VPN classification in a forensic manner [4]. VPN protocols offer various performances and levels of security. The protocols, including OpenVPN, PPTP, IPsec, and L2 TP, have their own strengths and weaknesses. Forensic investigators familiar with these protocols are able to identify the specific VPN technologies in use, which is also helpful in aiding the analysis of VPN traffic [5]. Recent advancements in machine learning for VPN traffic classification, as explored by [PERSON] [6; 7] and [PERSON] [8], have demonstrated significant progress in distinguishing between VPN and non-VPN traffic using time-related features and flow statistics data, respectively. [PERSON]'s work, in particular, highlighted the efficacy of using logistic regression, support vector machine, Naive Bayes, \(k\)-nearest neighbor, and ensemble methods (Random Forest and Gradient Boosting Tree classifiers) for traffic classification, identifying features that contribute to achieving high accuracy. Meanwhile, [PERSON]'s research on using a multi-layered perceptron neural network showcased the potential for high degrees of accuracy in detecting VPN usage, emphasizing the advancements in unauthorized user detection through network traffic analysis.