## 1 Introduction
Despite these advancements, the classification of encrypted VPN traffic using traditional machine learning techniques faces inherent limitations. The most notable challenges include high false-positive rates, as indicated by the research of [PERSON] et al. [9], and a comparatively low accuracy in distinguishing complex traffic patterns. These issues underscore the need for novel approaches that can enhance accuracy and reduce false positives. Moreover, existing machine learning solutions lack mechanisms for ensuring the transparency and security of the classification process, critical in the context of evolving cyber threats and regulatory requirements for data protection. Our research addresses this pressing need by introducing a novel solution that intertwines the advanced capabilities of Convolutional Neural Networks (CNNs) and Graph Neural Networks (GNNs) with the robustness and transparency of technology. This integrated approach is designed to revolutionize the domain of mobile VPN forensics by offering a more efficient, accurate, and secure method of analyzing VPN traffic. The reliability of VPN traffic classification can be enhanced by comparing the outputs of multiple models. Furthermore, we also propose to correlate the VPN traffic to its source in addition to identifying it merely. This will improve forensic analysis capabilities by allowing investigators to track back VPN connections to certain persons or businesses. The cornerstone of our solution lies in the utilization of CNN and GNN models. CNNs are renowned for their proficiency in processing and analyzing visual imagery, making them ideal for interpreting complex patterns within VPN traffic data. GNNs, on the other hand, excel in managing data that are structured as graphs, which is particularly pertinent to network traffic analysis. By combining these two neural network models, our approach can effectively discern intricate patterns and relationships in VPN usage, thereby enhancing the accuracy and depth of forensic analysis. To further augment the integrity and reliability of our forensic process, we integrate blockchain technology into our solution. Blockchain, with its inherent characteristics of decentralization, immutability, and transparency, provides a secure platform for storing and managing forensic data. By recording VPN traffic data on a blockchain, we ensure that the forensic evidence is tamper-proof and traceable, thereby enhancing the credibility and legal acceptability of the forensic process. Our contribution also includes the identification of the VPN software or protocol by examining the traffic patterns and distinctive features of various VPN clients. Eventually, investigators can use this information to profile the VPN software used by possible threat actors and better understand the methods and tools they are using. In essence, our proposed solution offers a cutting-edge approach to mobile VPN forensics, responding to the burgeoning challenges posed by the increased scrutiny of VPN usage worldwide. Through the synergistic use of CNN, GNN, and blockchain technology, we pave the way for a new era in digital forensics, marked by enhanced accuracy, security, and trustworthiness. Paper Organization: The rest of the paper is organized as follows, Section2 provides the selected literature review in the area of study. Section 3 provides the methodology of our proposed study containing the complete protocol of VPN forensics, blockchain integration, and data classification models. The blockchain implementation is shown in Section 4, and finally, Section 5 focuses on the results of VPN data and the processing, classification, and accuracy results.