Darknet Traffic Classification using Machine Learning Techniques

Iliadis, Lazaros Alexios; Kaifas, Theodorοs N.

doi:10.1109/mocast52088.2021.9493386

Cited by 22 publications

(8 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Darknet, an overlay network within the internet, is accessible only through specific software, configurations, or authorization and frequently employs custom communication protocols, as expounded by Wood et al 57 Two typical types of Darknet are social networks, commonly used for peer-to-peer file hosting, and anonymity proxy networks, such as TOR, characterized by a chain of anonymized connections. 58 In their work, an extensive performance evaluation of machine learning classifiers is provided for distinguishing VPN and TOR applications employed in Darknet traffic classification. The authors also compare the performance of various machine learning models using metrics like precision, recall, F-score, confusion matrices, and ROC curves.…”

Section: Encrypted Traffic Classificationmentioning

confidence: 99%

Explainable artificial intelligence for feature selection in network traffic classification: A comparative study

Khani,

Moeinaddini,

Abnavi

et al. 2024

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Over the past decade, there has been a growing surge of interest in leveraging artificial intelligence and machine learning models to address real‐world challenges within the field of telecommunications and networking. Among these challenges, network traffic classification has consistently remained a key focal point within the community. The emergence of new paradigms such as internet of things has added complexity to this challenge, owing to the diverse array of traffic classes it introduces. This complexity is further compounded when dealing with encrypted traffic data. In the context of this paper, we employ explainable artificial intelligence (XAI) techniques to offer insightful explanations for the task of classifying encrypted network traffic. Our approach involves presenting a ranked list of the model's input features, organized based on their significance in influencing the classifier's predictions. These ranked lists shed light on the underlying functionality of the encrypted traffic classification model, enabling users to discern which features hold greater importance in shaping the model's output by harnessing the insights provided by XAI approaches. Moreover, we carry out a quantitative assessment and comparison of the results generated by these XAI methods and outputs of three other conventional, widely adopted feature selection approaches, utilizing them as feature selection techniques when applied to a convolutional neural network for classifying data from the CIC‐Darknet2020 and CIC‐IDS2017 datasets. The results show that XAI techniques have high performance in feature selection for network traffic classification.

show abstract

Section: Encrypted Traffic Classificationmentioning

confidence: 99%

Explainable artificial intelligence for feature selection in network traffic classification: A comparative study

Khani,

Moeinaddini,

Abnavi

et al. 2024

Trans Emerging Tel Tech

View full text Add to dashboard Cite

show abstract

“…Study on obfuscated Tor traffic analysis [1], [2], [3] Non-obfuscated traffic Study on non-obfuscated traffic analysis [4], [5], [6], [7], [8], [9], [10], [11], [12], [13], [14], [15], [16], [17] Multiple browser classification Study classifying the darknet traffic into multiple browsers [18], [19], [20] Browser settings Classification of the darknet browser through its settings [21], [22], [23], [24], [25] Padded traffic detection Classification of traffic after applying the defense mechanism [6] Traffic classification under adversarial settings Classification of Tor traffic under adversarial settings [1], [26] Application-based…”

Section: Obfuscated Trafficmentioning

confidence: 99%

Darknet Traffic Analysis: A Systematic Literature Review

Saleem,

Islam,

Islam

2024

IEEE Access

View full text Add to dashboard Cite

The primary objective of an anonymity tool is to protect the anonymity of its users through the implementation of strong encryption and obfuscation techniques. As a result, it becomes very difficult to monitor and identify users' activities on these networks. Moreover, such systems have strong defensive mechanisms to protect users against potential risks, including the extraction of traffic characteristics and website fingerprinting. However, the strong anonymity feature also functions as a refuge for those involved in illicit activities who aim to avoid being traced on the network. As a result, a substantial body of research has been undertaken to examine and classify encrypted traffic using machine-learning techniques. This paper presents a comprehensive examination of the existing approaches utilized for the categorization of anonymous traffic as well as encrypted network traffic inside the darknet. Also, this paper presents a comprehensive analysis of methods of darknet traffic using ML (machine learning) techniques to monitor and identify the traffic attacks inside the darknet.

show abstract

“…It is a common misconception that criminals, drug users, terrorists, and sexual deviants use the Deep Web as a playground. The intranet of a firm is comparable to the deep web in the sense that no one from the outside of the company may access the information that is contained within it [14,15].…”

Section: Deep Webmentioning

confidence: 99%

Comparison of Data Fluctuations that Lead to Cyber Security Attacks: A Difference between Surface, Deep and Dark Net

Patel

2023

AJRCoS

View full text Add to dashboard Cite

The term "darknet" refers to the address space on the internet that is not being used, and users do not anticipate that this area will interact with their machines. Darknet is a source of cyber intelligence. In order to develop network security, it is necessary to conduct studies of the many dangers that comprise the network. In this research, we offer brand new machine learning classifiers that go by the name stacking ensemble learning. Their purpose is to evaluate and categorize darknet traffic. This novel approach employs predictions created by three different base learning techniques in order to deal with the issues relating to darknet attacks. The software was validated using a dataset that had more than 141,000 records and was derived from the CIC-Darknet 2020 database. The findings of the experiment indicated that the classifiers used in the investigation were able to easily differentiate between benign and malignant traffic. The classifiers have the ability to efficiently recognize known as well as unknown threats with a high degree of precision and accuracy that is greater than 99% in the training and 97% in the testing phases, with increments ranging from 4 to 64% based on the algorithms that are currently in use. As a consequence of this, the suggested system will become more reliable and accurate as more data is collected. Additionally, in comparison to other AI algorithms already available, the suggested system has the lowest standard deviation.

show abstract

Darknet Traffic Classification using Machine Learning Techniques

Cited by 22 publications

References 8 publications

Explainable artificial intelligence for feature selection in network traffic classification: A comparative study

Explainable artificial intelligence for feature selection in network traffic classification: A comparative study

Darknet Traffic Analysis: A Systematic Literature Review

Comparison of Data Fluctuations that Lead to Cyber Security Attacks: A Difference between Surface, Deep and Dark Net

Contact Info

Product

Resources

About