A system comprising a processor; and a memory to store data used by the processor, wherein the processor is operative to: access first data items used to train a classifier for classifying encrypted network traffic in relation to suspected dangerous malware; access second data items, the second data items being distinct from the first data items and not used to perform classification using the classifier; produce the trained classifier based on training using the first data items, the classifier comprising a decision tree having branch nodes (210a-210g) and leaf nodes (220a-220h) and wherein the classifier is trained using a Random Forest algorithm comprising defining, at each branch node, a split function for splitting the first data items; store in the trained classifier, as decision determining information at branch nodes of the decision tree, information of the first data items; and also store in the trained classifier at branch nodes of the decision tree, in association with the decision determining information, decision explanation information (252, 253) of the second data items, the decision explanation information comprising an indicator of compromise, IOC, determined based on behavior of data items deemed as suspicious when executed in a sandbox environment at a time of training the classifier but wherein the IOC is not available at a time of classification for an item to be classified; wherein storing the decision explanation information comprises, for each branch node of the trained classifier: assigning a label to each data item executed in the sandbox environment based on the split function for the branch node as applied to one of the first data items that is paired with the respective data item executed in the sandbox environment; determining a split function for the data items executed in the sandbox environment based on the assigned labels; and storing, in the trained classifier, decision explanation information at the branch node based on the determined split function for the data items executed in the sandbox environment. access first data items used to train a classifier for classifying encrypted network traffic in relation to suspected dangerous malware; access second data items, the second data items being distinct from the first data items and not used to perform classification using the classifier; produce the trained classifier based on training using the first data items, the classifier comprising a decision tree having branch nodes (210a-210g) and leaf nodes (220a-220h) and wherein the classifier is trained using a Random Forest algorithm comprising defining, at each branch node, a split function for splitting the first data items; store in the trained classifier, as decision determining information at branch nodes of the decision tree, information of the first data items; and also store in the trained classifier at branch nodes of the decision tree, in association with the decision determining information, decision explanation information (252, 253) of the second data items, the decision explanation information comprising an indicator of compromise, IOC, determined based on behavior of data items deemed as suspicious when executed in a sandbox environment at a time of training the classifier but wherein the IOC is not available at a time of classification for an item to be classified; wherein storing the decision explanation information comprises, for each branch node of the trained classifier: assigning a label to each data item executed in the sandbox environment based on the split function for the branch node as applied to one of the first data items that is paired with the respective data item executed in the sandbox environment; determining a split function for the data items executed in the sandbox environment based on the assigned labels; and storing, in the trained classifier, decision explanation information at the branch node based on the determined split function for the data items executed in the sandbox environment. assigning a label to each data item executed in the sandbox environment based on the split function for the branch node as applied to one of the first data items that is paired with the respective data item executed in the sandbox environment; determining a split function for the data items executed in the sandbox environment based on the assigned labels; and storing, in the trained classifier, decision explanation information at the branch node based on the determined split function for the data items executed in the sandbox environment.