Abstract:Darknet traffic classification is crucial for identifying anonymous network applications and defensing cyber crimes. Although notable research efforts have been dedicated to classifying darknet traffic by combining machine learning algorithms and elaborately designed features, current methods either heavily depend on hand-crafted features or overlook the global intrinsic relationships among the local features automatically extracted from different data positions, leading to limited classification performance. To tackle this issue, we propose DarknetSec, a novel self-attentive deep learning method for darknet traffic classification and application identification. Concretely, DarknetSec utilizes a cascaded model with a 1-dimensional Convolutional Neural Network (1D CNN) and a bidirectional Long Short-Term Memory (Bi-LSTM) network to capture local spatial-temporal features from the payload content of packets, while the self-attention mechanism is integrated into the abovementioned feature extraction network to mine the intrinsic relationships and hidden connections among the previously extracted content features. In addition, DarknetSec extracts side-channel features from payload statistics to enhance its classification performance. We evaluate DarknetSec on the CICDarknet2020 dataset, which is a representative of darknet traffic covering both Virtual Private Network (VPN) and The Onion Router (Tor) applications. Thorough experiments show that DarknetSec is superior to other state-of-the-art methods, achieving a multiclass accuracy of 92.22% and a macro-F1-score of 92.10%. Additionally, DarknetSec maintains its high accuracy when applied to other encrypted traffic classification tasks.

AN-Net: an Anti-Noise Network for Anonymous Traffic Classification

Noise is the Fatal Poison: A Noise-aware Network for Noisy Dataset Classification

A Cost-Sensitive Deep Learning-Based Approach for Network Traffic Classification

RBLJAN: Robust Byte-Label Joint Attention Network for Network Traffic Classification

Anonymous Traffic Detection Based on Feature Engineering and Reinforcement Learning

Flow Transformer: A Novel Anonymity Network Traffic Classifier with Attention Mechanism

Anonymous Network Communication Based on SDN

An Encrypted Malicious Traffic Detection System Based on Neural Network

Encrypted Network Traffic Classification Using Deep And Parallel Network-In-Network Models

DarknetSec: A novel self-attentive deep learning method for darknet traffic classification and application identification

MATEC: A lightweight neural network for online encrypted traffic classification

SAFSN: A Self-Attention Based Neural Network for Encrypted Mobile Traffic Classification

SD-Transformer: A System-Level Denoising Transformer for Encrypted Traffic Behavior Identification

An Encrypted Traffic Classification Method Combining Graph Convolutional Network and Autoencoder

Automatic Mobile App Identification From Encrypted Traffic With Hybrid Neural Networks

Anonymous Routing For Wireless Network Coding

A Novel Lightweight Anonymous Proxy Traffic Detection Method Based on Spatio-Temporal Features.

Yet Another Traffic Classifier: A Masked Autoencoder Based Traffic Transformer with Multi-Level Flow Representation.

End-to-end encrypted traffic classification with one-dimensional convolution neural networks

Traffic Classification of User Behaviors in Tor, I2P, ZeroNet, Freenet

Hybrid Internet Traffic Classification Technique