## 2 Literature Review
### Advanced Machine Learning Techniques for VPN Classification  
Since Convolutional Neural Networks (CNNs) are a subset of deep learning models, they have demonstrated outstanding performance in image recognition tests(c.f Figure 1). In the subject of VPN categorization, their capacity to manage significant amounts of data and automatically learn pertinent properties has sparked interest. CNNs have been used to depict network traffic using both image-based representations and time-series. A CNN-based technique was put forth in one study by [PERSON], [PERSON] et al. (2022) for classifying encrypted traffic, including VPNs [29]. They created a two-dimensional, grayscale image from the raw network traffic and used that as the input for the CNN model. The technique achieved good classification accuracy across a number of datasets, displaying encouraging findings with accuracy ranging from 91% to 99%. A CNN was used in a different study by [PERSON], [PERSON], [PERSON], and [PERSON] (2021) to categorise network traffic using time-series data [30]. One of the ideas given by [PERSON] et al. [31] discusses the limitations of relying solely on neural networks (NNs) for classifying encrypted traffic, asserting that NNs alone cannot achieve 100% classification accuracy. This paper suggests that incorporating the Server Name Indication (SNI) field, which remains unencrypted during the TLS handshake and discloses the server's hostname, enhances classification algorithms. The rationale is that including SNI data provides additional clear text information that aids in the more accurate classification of encrypted traffic. Figure 1: A Convolutional Neural Network with three hidden layers and an output layer. Further explanation is provided in Section 3.2. However, this critique and the proposed SNI-based solution focus on a specific aspect of network security and do not address the complexities of Virtual Private Networks (VPNs). VPNs are fundamentally designed to secure internet connections by establishing a private network over a public internet infrastructure. They play a crucial role in masking a user's IP address, thus making online actions virtually untraceable and enhancing privacy and security--areas not covered by the SNI-based classification approach. Our research diverges significantly from the issues addressed by the SNI-based method. In our paper, \"Integrating Blockchain and Deep Learning for Enhanced Mobile VPN Forensics\", we explore the application of advanced neural networks, specifically Convolutional Neural Networks (CNNs) and Graph Neural Networks (GNNs), in the classification of VPN traffic. This approach is not merely about overcoming the encryption challenges but also about providing a method to analyze and understand complex patterns within encrypted VPN traffic, which goes beyond the capabilities of basic SNI data exploitation. Furthermore, our work incorporates blockchain technology to add a layer of security and transparency that is absent in traditional neural network applications. By leveraging blockchain, we ensure that every transaction and classification operation within the VPN is recorded in an immutable ledger, enhancing the integrity and verifiability of forensic data. This approach not only addresses the limitations of NNs as discussed in the referenced paper but also extends the functionality to meet the stringent requirements of legal and security frameworks in today's digital landscape. The network traffic was represented as a sequence of arrival times and packet sizes, which was then eventually used as an input into the CNN model for the network traffic analysis. This approach exceeded traditional machine learning techniques in excellence and demonstrated high classification accuracy. Exploration of GNNs for network traffic analysis and VPN classification are researched lately.