## 3 Methodology
#### Direct Comparison

To articulate the improvements our approach introduces, we compare our results with those documented in the existing literature, focusing on similar application domains. For instance, while the Convolutional Neural Network (CNN) model demonstrates a high accuracy of 95.1% and an F1 score of 95.4%, it is our Graph Neural Network (GNN) model that marks a significant leap forward, achieving an accuracy of 99.2% and an F1 score of 99.3%. These figures not only surpass those achieved by traditional CNN approaches but also reflect a substantial advancement over results reported in prior studies, where similar metrics rarely breached the 90% threshold. Moreover, the precision and recall scores of our GNN model, standing at 99.2% and 99.6% respectively, further validate its superior capability in minimizing false positives and accurately identifying VPN and non-VPN traffic, a critical consideration for effective network management and security. This performance contrasts sharply with the existing methods, where the balance between precision and recall often proves challenging, particularly in datasets with complex and nuanced patterns of network traffic. ## 6 Conclusions

This research introduces a unique method of VPN traffic classification in a forensic setting using Graph Neural Networks (GNNs) and Convolutional Neural Networks (CNNs). Our approach using the strengths of both CNNs and GNNs give a complete solution for VPN traffic classification, allowing forensic investigators to distinguish between VPN and non-VPN traffic pertaining to a particular application. According to our findings, the proposed method can predict VPN traffic with 99.2% accuracy when using GNN models and 95.1% accuracy when using CNN models, both of which are highly accurate when it comes to identifying VPN traffic. These findings imply that by lowering false positives and boosting the dependability of forensic analysis, our approach can greatly increase the accuracy of VPN traffic classification. Additionally, our method links VPN traffic to its original source in addition to just identifying it. We also suggest identifying the application whose traffic is forwarded via

$and$0 Precision score for CNN and GNN. VPN connections, as this may reveal vital information within an organization about any harmful behavior or rule violations. The outcomes so far have been encouraging, but there are still a number of difficult problems that will need to be resolved in the future. These include issues with privacy while processing network traffic data and the dynamic nature of VPN traffic. The use of advanced machine learning techniques, such as CNNs and GNNs, is especially significant since it comes with a number of challenges, including the need for a sizable data collection and the computationally costly nature of deep learning models. As far as a future direction is concerned, the future researchers should include creating more effective CNN and GNN architectures that could handle the difficulties unique to VPN classification, investigating transfer learning strategies to make use of previously trained models, and looking into ways to combine various deep learning model types to enhance classification performance. By offering a useful way for categorizing VPN data and assisting forensic analysts in their analysis, our work generally makes a contribution to the field of VPN traffic classification in a forensic context. We finally believe that our method can be a useful tool for security experts and forensic analysts in their work to examine VPN traffic and find potential threats. Conceptualization, T.A.S. and S.S.A. ; methodology, T.A.S. ; software, S.S.A. ; formal analysis, T.A.S. ; investigation, T.A.S. ; resources, S.S.A. ; data curation, S.S.A. ; writing--original draft preparation, T.A.S. ; writing--review and editing, S.S.A. and T.A.S. ; visualization, T.A.S. ; supervision, S.S.A. ; project administration, S.S.A. ; funding acquisition, S.S.A. All authors have read and agreed to the published version of the manuscript.