Deep Neural Classification of Darknet Traffic

Abstract

Darknet is an encrypted portion of the internet for users who intend to hide their identity. Darknet’s anonymous nature makes it an effective tool for illegal online activities such as drug trafficking, terrorist activities, and dark marketplaces. Darknet traffic recognition is essential in monitoring and detection of malicious online activities. However, due to the anonymizing strategies used for the darknet to conceal users’ identity, traffic recognition is practically challenging. The state-of-the-art recognition systems are empowered by artificial intelligence techniques to segregate the Darknet traffic data. Since they rely on processed features and balancing techniques, these systems suffer from low performance, inability to discover hidden relations in data, and high computational complexity. In this paper, we propose a novel decision support system named Tor-VPN detector to classify raw darknet traffic into four classes of Tor, non-Tor, VPN, and non-VPN. The detector discovers complex non-linear relations from raw darknet traffic by our deep neural network architecture with 79 input artificial neurons and 6 hidden layers. To evaluate the performance of the proposed method, analyses are conducted on a benchmark dataset of DIDarknet. Our model outperforms the state-of-the-art neural network for darknet traffic classification with an accuracy of 96%. These results demonstrate the power of our model in handling darknet traffic without using any preprocessing techniques, like feature extraction or balancing techniques.

Darknet Traffic Analysis: A Systematic Literature Review

“…Study on obfuscated Tor traffic analysis [1], [2], [3] Non-obfuscated traffic Study on non-obfuscated traffic analysis [4], [5], [6], [7], [8], [9], [10], [11], [12], [13], [14], [15], [16], [17] Multiple browser classification Study classifying the darknet traffic into multiple browsers [18], [19], [20] Browser settings Classification of the darknet browser through its settings [21], [22], [23], [24], [25] Padded traffic detection Classification of traffic after applying the defense mechanism [6] Traffic classification under adversarial settings Classification of Tor traffic under adversarial settings [1], [26] Application-based…”

“…Alimoradi et al [9] suggested a novel decision support system called a Tor-VPN detector to categorize raw darknet data. The detector uses a deep neural network design with 79 input artificial neurons and six hidden layers to uncover complicated nonlinear relations from raw darknet traffic.…”

Colour Image Multilevel Thresholding Segmentation Using Trees Social Relationship Algorithm

“…The global process uses the principles of exploration and exploitation to enhance the algorithm's performance. The global process stops when a predefined number of iterations is reached, and the best solution in the forest is returned [10], [41].…”

Statistic Deviation Mode Balancer (SDMB): A novel sampling algorithm for imbalanced data

“…The main purpose of the machine learning algorithm is to learn correctly and, more importantly, to answer test samples correctly. For this reason, one of the important research fields in data mining is data balancing [3], [4]. Data that does not have an equal value of all classes of instances is called an imbalance.…”