Abstract

The network security sector has observed a rise in severe attacks emanating from the darknet or encrypted networks in recent years. Network intrusion detection systems (NIDS) capable of detecting darknet or encrypted traffic must be developed to increase system security. Machine learning algorithms can effectively detect darknet activities when trained on encrypted and conventional network data. However, the performance of the system may be influenced, among other things, by the choice of machine learning models, data preparation techniques, and feature selection methodologies. The histogram-based gradient boosting strategy known as categorical boosting (CatBoost) was tested to see how well it could find darknet traffic. The performance of the model was examined using feature selection strategies such as correlation coefficient, variance threshold, SelectKBest, and recursive feature removal (RFE). Following the categorization of traffic as “darknet” or “regular”, a multi-class classification was used to determine the software application associated with the traffic. Further study was carried out on well-known machine learning methods such as random forests (RF), decision trees (DT), linear support vector classifier (SVC Linear), and long-short term memory (LST) (LSTM). The proposed model achieved good results with 98.51% binary classification accuracy and 88% multi-class classification accuracy.

Original language	en
Pages (from-to)	795-807
Publication status	Published - 2023