## 7 Conclusions  
In summary, we have analyzed the key aspects of packet classification CNN-based methodologies, with a focus on their wise choices, to replicate them, and mistakes, to avoid them. With such information, we built a model that achieved state-of-the-art performance for the most used dataset, ISCX VPN vs. nonVPN [33], and analyzed the model's predicted traffic class using GradCAM, an XAI technique for convolutional feature extraction. The conclusion of the analysis is that, after removing all kind of biases that identify the flow or the servers, the model only looks at the packet size to make a decision. Consequently, we were able to match the performance by just using a decision tree on the packet size. Despite having analyzed CNNs for the most popular dataset in encrypted network packet classification, this methodology can be applied to other datasets with different categories. Next, we detail the most important contributions of this work. 1. _Poor experimental protocols result in an unrealistic performance evaluation:_ As has been shown, the bias introduced in CNN training and validation datasets has not been sufficiently taken into consideration before. This can be demonstrated by separating the traffic flows in the dataset preparation process. The neural network will learn based on data closer to what can be expected from a real traffic network; however, the real accuracy will be limited compared to the theoretical results of other authors. We propose a better experimental protocol by ensuring that biases are eliminated from the dataset and avoiding data leakage from the training set to the test set. 2. _XAI techniques are of great help in the assessment of the model:_ Using the XAI techniques discussed above, it has been shown that caution must be had when preprocessing data, as the model might find not be able to properly identify the classes if two flows that behave differently (client and server flows) are aggregated into one category. Moreover, the use of a heatmap shows that the correlations found in the trace by the model are purely statistical and not based on concrete evidence or certain values of metadata, so more strict codification that further diffuses the statistical traits of the payload will affect the accuracy of the model significantly. The use of heatmaps helps to understand the viability of the model in practical scenarios, where the point of interest of the model can be extracted and discussed in order to determine if the training exercise was successful or not. 3. _CNNs do not detect significant features in encrypted payloads:_ Based on the presented results, CNNs do not seem to be the right tool to classify encrypted network packets, as they are just focusing on the packet length. Just adding random lengths of padding to the packets in encrypted traffic would be enough to make such classifications unfeasible, at the cost of more payload per packet. This could be a good solution for users' privacy, but it is an inadequate one for the network operators and systems, which would need to find other solutions to classify the network traffic and handle the extra computing load and bandwidth. On the other hand, before packets include random padding, this conclusion provides a valid means to heuristically classify the traffic at high speed, just by looking at the packet lengths. Regarding limitations, in this work we have only addressed CNNs with a technique, GradCAM, specific for CNNs. Using a generic CNN allowed us to focus on the convolutional features in network encrypted packets. While GradCAM allowed us to extract deeper information about CNNs, it also limited our study to convolutional features. Nowadays, other techniques--e.g., Transformers--are emerging, and their rapid development again poses the challenge of understanding what they are learning. This opens the topic of extracting and understanding more complex features to improve the differentiation between traffic patterns.