# CNN for User Activity Detection Using Encrypted In-App Mobile Data
## 2 Related Work  
In the literature, two types of research methods have dominated traffic classification: statistical methods and neural networks. Statistical classification is a technique that exploits the statistical characteristics of network traffic flow to perform traffic classification. Features, such as packet length, packet duration, packet inter-arrival time, and traffic flow idle time, are used in this method. To perform an actual classification based on statistical features, classifiers, specifically ML algorithms, are used. [PERSON] et al. [9] performed mobile user actions classification based on packet sizes and their order. [PERSON] et al. [5] developed NetScope to detect user activities based on inspecting statistical features obtained from internet protocol (IP) headers. [PERSON] et al. [2; 10] used features, such as packet lengths and statistical properties of flows, to train support vector classifier (SVCs) and random forest classifiers to perform mobile app classification. [PERSON] et al. [4] identified user activities performed on mobile apps using statistical features generated from frame length, inter-arrival time, and direction leaked from encrypted traffic. [PERSON] et al. [3] computed 20 statistical features from frame size and inter-arrival time to train an RF classifier to perform app identification. [PERSON] et al. [11] proposed a scheme by combining supervised and unsupervised machine learning techniques to classify apps. Twenty unidirectional flow statistical features related to packet size, packets, inter-packet time, and bytes were extracted and used to train the proposed classifier. A classification method was proposed by [PERSON] et al. [12] with only time-related flow features on both regular encrypted traffic and protocol encapsulated traffic. Many works have applied neural networks in network traffic analysis such as malware classification [13], anomaly detection [14], DDoS attacks detection [15], and intrusion detection [16; 17]. In [18], [PERSON] et al. proposed an end-to-end encrypted traffic classification approach with 1D CNN to detect traffic types such as streaming, VoIP, and file transfer. [PERSON] et al. [19] proposed using a recurrent neural network (RNN) combined with a CNN for IoT traffic classification. In [20], [PERSON] et al. performed traffic classification in encrypted network flow using DL techniques. [PERSON] [21] proposed a stacked auto encoder (SAE)-based method to detect network protocols. The results showed that [PERSON]'s approach worked well on the applications of feature learning, protocol classification, anomalous protocol detection, and unknown protocol identification. In [22], [PERSON] et al. proposed a framework to perform traffic characterization and application identification using DL, embedding an SAE and CNN to classify network traffic. Recent studies have explored the use of CNNs to perform classification by converting network traffic flows into images. [PERSON] et al. [13] converted traffic to 2D images and then applied 2D CNN to classify the traffic images achieving the goal of malware classification. [PERSON] et al. [8] proposed a CNN model that predicts large-scale, network-wide traffic speed. In this work, spatiotemporal traffic dynamics were converted to images describing the time and space relations of traffic flow via a 2D time-space matrix. [PERSON] et al. [6] proposed a classification algorithm Min-Max Normalization (MMN) CNN that processes traffic data and maps them into gray images that are input into a CNN to detect 12 types of traffic categories such as mail, game, and multimedia. [PERSON] [23] presented the Seq2 Image method to perform human genomic sequence classification converting genome sequences to images and then using a 2D CNN to classify the created images of sequences. [PERSON] et al. [7] presented the FlowPic approach to transform flow data into an image and then used image classification DL techniques, a CNN, to identify the flow category and application in use. [PERSON] et al.