DarkDetect: Darknet Traffic Detection and Categorization Using Modified Convolution-Long Short-Term Memory

Abstract

Darknet is commonly known as the epicenter of illegal online activities. An analysis of darknet traffic is essential to monitor real-time applications and activities running over the Darknet. Recognizing network traffic bound to unused Internet addresses has become undeniably significant for identifying and examining malicious activities on the internet. Since there are no authentic hosts or devices in an unused address block, any observed network traffic must be the aftereffect of misconfiguration from spoofed source addressed and other frameworks that monitor unused address space. However, the recent advancements in artificial intelligence allow digital systems to detect and identify darknet traffic autonomously. In this paper, we propose a generalized approach for darknet traffic detection and categorization using Deep Learning. We examine the state-of-the-art complex dataset, which provides excessive information about the darknet traffic and perform data preprocessing. Next, we analyze diverse feature selection techniques to select optimal features for darknet traffic detection and categorization. We apply fine-tuned machine learning (ML) algorithms which include Decision Tree (DT), Gradient Boosting (GB), Random Forest Regressor (RFR), and Extreme Gradient Boosting (XGB) on selected features and compare the performance. Next, we apply modified Convolution-Long Short-Term Memory (CNN-LSTM) and Convolution-Gradient Recurrent Unit (CNN-GRU) deep learning techniques to recognize the network traffic more accurately. The results demonstrate that the proposed approach outperforms the existing approaches by yielding the maximum accuracy of 96% of darknet traffic detection and 89% of darknet traffic categorization through XGB as a feature selection approach and CNN-LSTM a recognition model.

Explainable artificial intelligence for feature selection in network traffic classification: A comparative study

“…Furthermore, Sarwar et al 59 present an approach to darknet traffic detection and categorization, relying on machine learning algorithms and a CNN‐based deep learning classifier. Lashkari et al 60 propose a novel approach that classifies and characterizes various hidden services and applications in the Darknet.…”

DarkGuardNet: A deep learning framework for imbalanced dark web traffic identification and application classification

“…Sarwar et al [3] conducted research using CNN, LSTM, and Gated Recurrent Unit (GRU) for traffic and application type classification. To address the issue of imbalanced dataset samples, they applied oversampling techniques.…”

Darknet traffic analysis, and classification system based on modified stacking ensemble learning algorithms

“…Darknet traffic identification and categorization using deep learning were proposed by Sarwar et al ( 2021a ) in their execution of data preprocessing on the complex, state-of-the-art dataset. Next, they examined various feature selection strategies to determine the most compelling features for detecting and categorizing darknet traffic.…”

“…Meanwhile, Sarwar et al ( 2021b ) used a CNN with the long short-term memory (LSTM) and gated recurrent units (GRUs) deep learning techniques in an attempt to identify traffic and application type (GRU). On Tor, they used the synthetic minority oversampling technique (SMOTE) to address the issue of an imbalanced dataset.…”