## 2 Related Work
### State of the Art  
Machine learning techniques have been progressing and evolving since the mid-nineteen-nineties, but the first proposals to use modern machine learning techniques for network traffic classification became popular around the 2000s. A relevant example is SVMs, appearing around 2002 [6]. Nowadays, XAI has gained a pivotal role in the use of modern Artificial Intelligence (AI) in the research community [7], because the difficulties in interpreting deep learning models prevent their use in real scenarios as the need for accountability, responsibility, and transparency in decisions arises. Additionally, the unknown properties and behavior of the model make further improvements much harder to grasp, as we do not have proficient metrics that help us define better hyperparameters. Different authors have applied a wide variety of machine learning techniques to network traffic classification. Different datasets, models, applications, and methodologies have been used, such as Multilayer Perceptron, CNNs, Recurrent Neural Networks (RNNs), Autoencoders, and other types of layers [8; 9; 10; 11]. Currently, deep learning has established itself as one of the main tools in the area of network traffic classification. However, few studies have addressed how to classify the traffic in real-world situations. The research made by [12] must be taken as a warning sign: we must develop stronger tools to further prove and test the models, as most of them heavily underperform in real scenarios due to a lack of generalization and a misjudgment of the true capabilities of the model. Additionally, these techniques are sometimes applied to non-encrypted packets, which are not representative of the current networks. Our work focuses only on encrypted TLS payloads, so neither the header nor the data format can leak information about the corresponding label. This will be discussed extensively in Section 3. The authors of [4], one of the first references on using deep learning for traffic classification, show how to detect malicious traffic using CNNs. They process the network packets to display them as 2D images, and it is observed that, depending on the type of application, they can see specific patterns. This is promising because it means that, even if the traffic is encrypted, there might be a way to classify it according to the application. The works in [13; 14] show that such techniques used in other fields, such as image or video classification, can be applied in network and service management, bringing a new perspective into some challenges in the area and opening up the entire field for a different point of view. Similarly, we have applied and extended XAI techniques, reaffirming their strengths and addressing the state-of-the-art challenge of understanding traffic classification. Previous studies have demonstrated the ability of neural networks to achieve high levels of accuracy in the classification of encrypted and non-encrypted traffic. However, a significant challenge remains in the application of such techniques in real-world environments where low latency and high processing rates are required. In such scenarios, waiting for the arrival of a sufficient number of packets to classify a flow is not feasible and classification must be performed on individual packets in real time. To address this challenge, recent studies have proposed a method whereby network traffic packets are processed and displayed as 2D grayscale images, which can reveal discernible patterns depending on the type of application. This approach is particularly noteworthy as it enables classification of encrypted traffic based on the source application. Consequently, it presents an opportunity for Internet Service Providers (ISPs) to enforceservice differentiation policies while ensuring the protection of user data. In order to harness these unique patterns, CNNs are employed as an image classification model. CNNs have been extensively investigated in recent years for their ability to effectively solve real-world image classification problems.