Abstract:Darknet traffic classification is crucial for identifying anonymous network applications and defensing cyber crimes. Although notable research efforts have been dedicated to classifying darknet traffic by combining machine learning algorithms and elaborately designed features, current methods either heavily depend on hand-crafted features or overlook the global intrinsic relationships among the local features automatically extracted from different data positions, leading to limited classification performance. To tackle this issue, we propose DarknetSec, a novel self-attentive deep learning method for darknet traffic classification and application identification. Concretely, DarknetSec utilizes a cascaded model with a 1-dimensional Convolutional Neural Network (1D CNN) and a bidirectional Long Short-Term Memory (Bi-LSTM) network to capture local spatial-temporal features from the payload content of packets, while the self-attention mechanism is integrated into the abovementioned feature extraction network to mine the intrinsic relationships and hidden connections among the previously extracted content features. In addition, DarknetSec extracts side-channel features from payload statistics to enhance its classification performance. We evaluate DarknetSec on the CICDarknet2020 dataset, which is a representative of darknet traffic covering both Virtual Private Network (VPN) and The Onion Router (Tor) applications. Thorough experiments show that DarknetSec is superior to other state-of-the-art methods, achieving a multiclass accuracy of 92.22% and a macro-F1-score of 92.10%. Additionally, DarknetSec maintains its high accuracy when applied to other encrypted traffic classification tasks.

Detection of Darknet Space Resource based on Freenet

Darknet Resource Exploring based on Tor

An Intrusion Detection System Based on FRete Net Algorithm

Preliminary Exploration of I2P Resources in Darknet

Simulation of Dark Network Scene Based on the Big Data Environment

Plunge into the Underworld: A Survey on Emergence of Darknet

IPv6-Darknet Network Traffic Detection.

Freenet: A Distributed Anonymous Information Storage and Retrieval System

Zooming Into the Darknet: Characterizing Internet Background Radiation and its Structural Changes

DarknetSec: A novel self-attentive deep learning method for darknet traffic classification and application identification

Traffic Classification of User Behaviors in Tor, I2P, ZeroNet, Freenet

Detection of Sparse Anomalies in High-Dimensional Network Telescope Signals

A Big Data architecture for early identification and categorization of dark web sites

Darknet Traffic Analysis A Systematic Literature Review

A Survey of the Dark Web and Dark Market Research

A Novel Method of P2P Hosts Detection Based on Flexible Neural Tree

Darknet Traffic Analysis: A Systematic Literature Review

Darknet Traffic Big-Data Analysis and Network Management to Real-Time Automating the Malicious Intent Detection Process by a Weight Agnostic Neural Networks Framework

DANTE: A framework for mining and monitoring darknet traffic

Darknet Data Mining -- A Canadian Cyber-crime Perspective