LIDarknet: Experimenting the Power of Ensemble Learning in the Classification of Network Traffic

EasyChair Preprint no. 11097

Abstract

The Darknet is an encrypted corner of the internet, intended for users who wish to remain anonymous and mask their identity. Because of its anonymous qualities, the Darknet has become a go-to platform for illicit activities such as drug trafficking, terrorism, and dark marketplaces. Therefore, it is important to recognize Darknet traffic in order to monitor and detect malicious online activities. This paper investigates the potential effectiveness of machine learning algorithms in identifying attacks using the CICdarknet2020 dataset. The dataset includes two distinct classification targets: traffic label and application labels. The objective of our research is to identify optimal classifiers for traffic and application classification by employing ensemble learning methods, aiming to achieve the highest possible results. Through our experimentation, we have found that the best-performing models surpassing all other state-of-the-art machine learning models are LightGBM, achieving a 93.41% f1-score in the Application classification, and Random Forest, achieving a 99.8% f1-score in the traffic classification.

Keyphrases: ANOVA, Darknet, Ensemble learning methods, LightGBM, Random Forest, traffic analysis

@Booklet{EasyChair:11097,
  author = {Nabil Marzoug and Khidhr Halab and Younes Mamma and Fadoua Khennou and Othmane El Meslouhi},
  title = {LIDarknet: Experimenting the Power of Ensemble Learning in the Classification of Network Traffic},
  howpublished = {EasyChair Preprint no. 11097},

  year = {EasyChair, 2023}}