A method for training and validating machine learning algorithms used by a network traffic analyser for network traffic classification, in real network environments wherein real traffic (210, 310) is moving between an internal network and an external network, comprising the steps of: - generating synthetic traffic (111, 113) in real time; - the network traffic analyser receiving packets of traffic comprising a simultaneous mix of the real traffic (210, 310) and the generated synthetic traffic (111, 113) in real time; - aggregating the packets of the received traffic into network flows by using metadata; - transforming each network flow to generate a first dataset with a format readable by a machine learning algorithm, the first dataset comprising features defined by the metadata for each network flow; - labelling the real traffic (210, 310) and the synthetic traffic (111, 113) to obtain a labelled dataset which comprises the first dataset and additional features defined as labels, wherein the labelling is done by matching features from the first dataset and features identified from previously stored network logs, and assigning a label "unknown" if there is no match; - selecting a subset of the features from the labelled dataset to be used in an iterative training (2041, 507) to generate (2010, 508) a trained model; - filtering out a part of real traffic (210, 310) of the labelled dataset to obtain a second labelled dataset; - selecting the subset of features used in the trained model from the second labelled dataset to be used for validating the trained model; - comparing results predicted by the trained model with the actual labels obtained from labelling; - if the comparison is negative, repeating the previous steps with a different subset of features to generate another trained model. - generating synthetic traffic (111, 113) in real time; - the network traffic analyser receiving packets of traffic comprising a simultaneous mix of the real traffic (210, 310) and the generated synthetic traffic (111, 113) in real time; - aggregating the packets of the received traffic into network flows by using metadata; - transforming each network flow to generate a first dataset with a format readable by a machine learning algorithm, the first dataset comprising features defined by the metadata for each network flow; - labelling the real traffic (210, 310) and the synthetic traffic (111, 113) to obtain a labelled dataset which comprises the first dataset and additional features defined as labels, wherein the labelling is done by matching features from the first dataset and features identified from previously stored network logs, and assigning a label "unknown" if there is no match; - selecting a subset of the features from the labelled dataset to be used in an iterative training (2041, 507) to generate (2010, 508) a trained model; - filtering out a part of real traffic (210, 310) of the labelled dataset to obtain a second labelled dataset; - selecting the subset of features used in the trained model from the second labelled dataset to be used for validating the trained model; - comparing results predicted by the trained model with the actual labels obtained from labelling; - if the comparison is negative, repeating the previous steps with a different subset of features to generate another trained model.