## 3 Methodology
These results are essential in forensic investigations, providing critical information to guide response strategies, enforce security policies, and, when necessary, offer robust evidence in legal contexts. The conclusions drawn from the CNN's classifications thus play a crucial role in understanding the nature and severity of incidents involving VPN usage, ultimately strengthening organizational cybersecurity measures. For a comprehensive understanding of the implementation details and to access the full source code of our system, please refer to our GitHub repository. The repository includes all necessary components such as the Hyperledger Fabric chaincode, the application layer for interacting with the blockchain, the Convolutional Neural Network models, and configuration settings for setting up and running the system. Detailed documentation is also provided to guide users through the installation process and to assist in deploying and testing the system. The full source code is available at [[https://github.com/toqeer/vpn-code.git](https://github.com/toqeer/vpn-code.git)]([https://github.com/toqeer/vpn-code.git](https://github.com/toqeer/vpn-code.git)) (accessed on 29 April 2024). ## 5 Results and Analysis

To evaluate the efficiency and predictive potential of our trained models, it is crucial to employ certain performance metrics, forming a fundamental part of the machine learning pipeline. In our research, we have utilized three key metrics, namely, accuracy, recall, and F1-score, which collectively provide a robust assessment of our models' performance. It is important to note that the term 'accuracy' refers to the ratio in which correct predictions per sample are over the total number of samples. It gives us a general understanding of the effectiveness of our model. However, it does not distinguish between the numbers of correctly classified examples of different classes, which might be crucial when the classes are imbalanced. Hence, to further evaluate the performance, we also employ recall and F1-score, which consider both the precision and sensitivity of the model. Accuracy: In the process of data splitting, we strategically reserved 20% of our total dataset as a test set. This untouched portion of the data serves to test the predictive ability of our models, ensuring that we evaluate their performance on unseen data. Let us look at the performance of our two models--CNN and GNN. The trained CNN model was tested against our grayscale image representations of network traffic data to determine its ability to differentiate the VPN traffic from non-VPN traffic generated by specific applications. This test phase resulted in a high accuracy of 95.1%, which indicates that the CNN model correctly classified 95.1% of the cases as depicted in Figure 4. This implies that the CNN model was precise enough to detect the type of traffic in 95.1% of the cases, which shows high proficiency in identifying the traffic type over the network. On the other hand, the Graph Neural Network (GNN) model was put through the same test, only this time it was tasked to analyze graph-structured data. Remarkably, the GNN model was able to identify VPN and non-VPN traffic with 99.2% accuracy. One possible explanation for this perfect score could be the comprehensive representation of network traffic as a graph, enabling the model to take into account the dependencies between different network flows, thus making more accurate predictions. F1 score: Machine learning is heavily dependent on the F1 score, which is a metric that is particularly useful when dealing with uneven class distributions as it provides both a precision and recall measure. In machine learning, it is a significant metric. Its worst value is 0%, and its maximum value is 100% (perfect recall and precision). Our trained Convolutional Neural Network (CNN) models in this study distinguished between different classes of network traffic with an F1 score of 95.4%.