Abstract:Darknet traffic classification is crucial for identifying anonymous network applications and defensing cyber crimes. Although notable research efforts have been dedicated to classifying darknet traffic by combining machine learning algorithms and elaborately designed features, current methods either heavily depend on hand-crafted features or overlook the global intrinsic relationships among the local features automatically extracted from different data positions, leading to limited classification performance. To tackle this issue, we propose DarknetSec, a novel self-attentive deep learning method for darknet traffic classification and application identification. Concretely, DarknetSec utilizes a cascaded model with a 1-dimensional Convolutional Neural Network (1D CNN) and a bidirectional Long Short-Term Memory (Bi-LSTM) network to capture local spatial-temporal features from the payload content of packets, while the self-attention mechanism is integrated into the abovementioned feature extraction network to mine the intrinsic relationships and hidden connections among the previously extracted content features. In addition, DarknetSec extracts side-channel features from payload statistics to enhance its classification performance. We evaluate DarknetSec on the CICDarknet2020 dataset, which is a representative of darknet traffic covering both Virtual Private Network (VPN) and The Onion Router (Tor) applications. Thorough experiments show that DarknetSec is superior to other state-of-the-art methods, achieving a multiclass accuracy of 92.22% and a macro-F1-score of 92.10%. Additionally, DarknetSec maintains its high accuracy when applied to other encrypted traffic classification tasks.

DarknetSec: A novel self-attentive deep learning method for darknet traffic classification and application identification

A Cost-Sensitive Deep Learning-Based Approach for Network Traffic Classification

A SURVEY ON DEEP LEARNING TECHNIQUES FOR DARKNET TRAFFIC MALWARE DETECTION

Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning

Darknet Traffic Analysis: A Systematic Literature Review

Reinterpreting usability of semantic segmentation approach for darknet traffic analysis

RBLJAN: Robust Byte-Label Joint Attention Network for Network Traffic Classification

Multiclass objects detection algorithm using DarkNet-53 and DenseNet for intelligent vehicles

Darknet Traffic Analysis A Systematic Literature Review

SAM: Self-Attention based Deep Learning Method for Online Traffic Classification

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

MATEC: A lightweight neural network for online encrypted traffic classification

ECNet: Robust Malicious Network Traffic Detection With Multi-View Feature and Confidence Mechanism

A Novel Malware Traffic Classification Method Using Semi-Supervised Learning.

RM-Net: an Encrypted Traffic Classification Method Based on Deep Learning for Low Labeled Rate Scenarios

Encrypted Network Traffic Classification Using Deep And Parallel Network-In-Network Models

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

Deep Learning for Network Traffic Classification

Identification of Encrypted Traffic Through Attention Mechanism Based Long Short Term Memory

Network Anomaly Intrusion Detection Based on Deep Learning Approach