Abstract:Despite being the most popular privacy-enhancing network, Tor is increasingly adopted by cybercriminals to obfuscate malicious traffic, hindering the identification of malware-related communications between compromised devices and Command and Control (C&C) servers. This malicious traffic can induce congestion and reduce Tor's performance, while encouraging network administrators to block Tor traffic. Recent research, however, demonstrates the potential for accurately classifying captured Tor traffic as malicious or benign. While existing efforts have addressed malware class identification, their performance remains limited, with micro-average precision and recall values around 70%. Accurately classifying specific malware classes is crucial for effective attack prevention and mitigation. Furthermore, understanding the unique patterns and attack vectors employed by different malware classes helps the development of robust and adaptable defence mechanisms. We utilise a multi-label classification technique based on Message-Passing Neural Networks, demonstrating its superiority over previous approaches such as Binary Relevance, Classifier Chains, and Label Powerset, by achieving micro-average precision (MAP) and recall (MAR) exceeding 90%. Compared to previous work, we significantly improve performance by 19.98%, 10.15%, and 59.21% in MAP, MAR, and Hamming Loss, respectively. Next, we employ Explainable Artificial Intelligence (XAI) techniques to interpret the decision-making process within these models. Finally, we assess the robustness of all techniques by crafting adversarial perturbations capable of manipulating classifier predictions and generating false positives and negatives.

Classifying Tor Traffic Encrypted Payload Using Machine Learning

IP Packet-Level Encrypted Traffic Classification Using Machine Learning with a Light Weight Feature Engineering Method

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

RNN-LSTM Based Deep Learning Model for Tor Traffic Classification

Machine Learning Classification on Traffic of Secondary Encryption

A Hierarchical Classification Approach for Tor Anonymous Traffic

Examining the Rat in the Tunnel: Interpretable Multi-Label Classification of Tor-based Malware

Classification of Encrypted Traffic with Second-Order Markov Chains and Application Attribute Bigrams.

Encrypted Network Traffic Analysis and Classification Utilizing Machine Learning

A Novel Application Classification Attack Against Tor

Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning

Distinguishing Tor From Other Encrypted Network Traffic Through Character Analysis

Internet Traffic Classification Using Machine Learning: A Token-based Approach

Network Traffic Classification Method Supporting Unknown Protocol Detection

Hybrid Internet Traffic Classification Technique

Application traffic classification based on command exchange mode of TCP flows

An Encrypted Malicious Traffic Detection System Based on Neural Network

Certificate-aware Encrypted Traffic Classification Using Second-Order Markov Chain

Seeing Traffic Paths: Encrypted Traffic Classification With Path Signature Features

Feature Analysis of Encrypted Malicious Traffic