Traffic Classification in Dark Web Using Machine Learning Models

Publications

Traffic Classification in Dark Web Using Machine Learning Models

Year : 2025

Publisher : Springer Science and Business Media Deutschland GmbH

Source Title : Lecture Notes in Networks and Systems

Document Type :

Abstract

The dark web is a collection of hidden content and web sites hosted on the darknet, which is not indexed by standard search engines and can only be accessed using specialized browsers like Tor, JonDonym, and I2P. As Internet technology advances, the threat to personal data security grows correspondingly, making the dark web a hub for malicious activities such as bank fraud, data theft, and security breaches. The content on the dark web is deliberately concealed from normal users, and its anonymity makes it a haven for illicit activities. Therefore, monitoring the darknet is crucial to detect data breaches and prevent serious consequences. Traffic classification plays a vital role in various areas such as security, service management, and research and development. In this experiment, traffic from dark web anonymity tools (Tor, JonDonym, and I2P) is classified at different levels of granularity, including network, traffic, and application levels. Initially, dark web traffic classification is conducted using four machine learning classifiers: naive Bayes, multinomial naive Bayes, decision tree, and random forest, utilizing a publicly available dataset. The impact of class imbalance within the dataset is also examined experimentally, employing the Synthetic Minority Oversampling TEchnique (SMOTE) to address the imbalance. Following this, the effectiveness of a neural network, specifically a multilayer perceptron, is evaluated for the classification task, and its performance is compared against the aforementioned classifiers.