## 4 Model Definition  
After reviewing all the publications in Section 2, we came up with a general schema of a convolutional architecture, depicted in Figure 5. It is divided into two parts:  
1. **Feature extraction:** In the very first part, the packets are inputted to the network, either as 1D or as 2D tensors. Then, they are fed into a convolutional layer. This convolutional layer uses small squared kernels (typically using an odd number, such as three or five, as kernel size) to apply a convolution with an optional activation function, such as sigmoid or ReLU. The output of this layer is as many images as the number of kernels. However, this convolutional layer lacks a reduction in dimensionality for a proper feature extraction. To perform a reduction of the size of the image, a max-pooling layer is typically employed. This layer consists of reducing the dimension by two or three on each axis by summarizing the information of squared patches of pixels into a single pixel that represents the maximum of the patch. One can consider other pooling operations, such as the minimum or the mean, but usually the maximum works better when using ReLU activations. These steps are repeated  
Figure 4: Comparison between both methods for dataset split.  
several times (\(D\) times in Figure 5) until the image is small enough to have captured few but interesting features.
2. **Feature analysis:** Once we extract features using convolutional mechanisms, the model just employs simple dense layers using standard activation functions to provide a final output. For this, we have to flatten the images by just concatenating them or using an RNN. By performing this, we obtain an analysis of the features that is concluded with the final layer that provides a probability by using a softmax activation function. Additionally, to avoid overfitting, weight regularizers and dropout mechanisms between each layer can be added during training.  
With this architecture, we built a generic CNN to be evaluated. The final selection of hyperparameters was made after a tuning process, for the best-in-class results of the model, so it would mostly benefit the model we were trying to optimize. In particular, Table 2 describes the 1D-CNN and the 2D-CNN models, respectively. Both of them use just two convolutional stages (\(D=2\)) since the size of the tensors after them is already small enough to complete feature extraction. All activation functions, except the one at the output, are ReLU, given its good performance and well-known characteristics to avoid any vanishing gradient issues. Since the size of the image is divided by two in each convolutional stage, we multiply the number of kernels by two in each stage, i.e., we have many smaller images and each of them focuses on a particular feature of the packet. For instance, for the 2D-CNN model, we have that the input is one image of \(32~{}\times~{}32\) pixels and the output of the feature extraction is 64 images of sizes \(6~{}\times~{}6\) (or \(8~{}\times~{}8\) if we had considered a convolution layer with border padding).  
\begin{table}
\begin{tabular}{c c} \hline \hline \multicolumn{2}{c}{**Common Parameters**} \\ \hline Optimizer & Adam \\ Kernel Size & 3 \\ Dropout Rate & 0.5 \\ Activation & ReLU \\ Loss func. & Cross-entropy \\ Epochs per training & 50 \\ \hline \multicolumn{2}{c}{1D model} \\ \hline Max-Pool Size & 2 \\ Number of Conv2D stages & 2 \\ Number of fully connected stages & 2 \\ Number of LSTM stages (when used) & 2 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Model parameters.  
Figure 5: General CNN architecture with \(D\) convolutional stages.