Detecting and Classifying Darknet Traffic Using Deep Network Chains  

作　　者：Amr Munshi Majid Alotaibi Saud Alotaibi Wesam Al-Sabban Nasser Allheeib 

机构地区：[1]Computer Engineering Department,Umm Al-Qura University,Mecca,Saudi Arabia [2]Smart Lab,Umm Al-Qura University,Mecca,Saudi Arabia [3]Information Systems Department,Umm Al-Qura University,Mecca,Saudi Arabia [4]College of Computer and Information Sciences,King Saud University,Riyadh,Saudi Arabia

出　　处：《Computer Systems Science & Engineering》2023年第10期891-902,共12页计算机系统科学与工程（英文）

摘　　要：The anonymity of the darknet makes it attractive to secure communication lines from censorship.The analysis,monitoring,and categorization of Internet network traffic are essential for detecting darknet traffic that can generate a comprehensive characterization of dangerous users and assist in tracing malicious activities and reducing cybercrime.Furthermore,classifying darknet traffic is essential for real-time applications such as the timely monitoring of malware before attacks occur.This paper presents a two-stage deep network chain for detecting and classifying darknet traffic.In the first stage,anonymized darknet traffic,including VPN and Tor traffic related to hidden services provided by darknets,is detected.In the second stage,traffic related to VPNs and Tor services is classified based on their respective applications.The methodology of this paper was verified on a benchmark dataset containing VPN and Tor traffic.It achieved an accuracy of 96.8%and 94.4%in the detection and classification stages,respectively.Optimization and parameter tuning were performed in both stages to achieve more accurate results,enabling practitioners to combat alleged malicious activities and further detect such activities after outbreaks.In the classification stage,it was observed that the misclassifications were due to the audio and video streaming commonly used in shared real-time protocols.However,in cases where it is desired to distinguish between such activities accurately,the presented deep chain classifier can accommodate additional classifiers.Furthermore,additional classifiers could be added to the chain to categorize specific activities of interest further.

关 键 词：DARKNET darknet traffic deep network chains Internet traffic 

分 类 号：TP311.13[自动化与计算机技术—计算机软件与理论]