Search papers, labs, and topics across Lattice.
This study introduces a behavioral information leakage framework that analyzes darknet traffic by decomposing flow-level data into control, structural, and rhythmic descriptors across various anonymity networks, including Tor and FreeNet. By employing normalized mutual information analysis alongside Random Forest validation and cross-network evaluations, the authors reveal significant variations in behavioral leakage, with Tor displaying the highest service separability. Key findings indicate that packet organization and timing behaviors are critical leakage mechanisms, with implications for understanding and mitigating risks in encrypted service environments.
Tor's traffic reveals a striking 3.9461 cumulative leakage, highlighting critical behavioral patterns that could inform future anonymity network designs.
Existing darknet traffic classification studies largely emphasize predictive accuracy while offering limited insight into the behavioral mechanisms that make encrypted services distinguishable. This paper proposes a behavioral information leakage framework that decomposes flow-level traffic into control, structural, and rhythmic descriptor groups across Tor, I2P, FreeNet, and ZeroNet. The framework combines normalized mutual information analysis with Random Forest-based predictive validation, structural-rhythmic interaction analysis, and cross-network service-variability evaluation under leakage-safe repeated stratified cross-validation. Results show that behavioral leakage varies considerably across anonymity networks. Tor achieves the highest service separability, with a Macro-F1 of 0.7165 and cumulative normalized leakage of 3.9461, whereas FreeNet exhibits the lowest combined leakage of 0.8744. Packet-size organization, directional exchange imbalance, packet tempo, and silence-burst behavior emerge as the main leakage mechanisms. The combined structural-rhythmic representation consistently provides the strongest within-network performance, while leave-one-network-out evaluation reveals limited transferability across anonymity architectures. The proposed Service Variability Index and Leakage Variability Index further show that video exhibits consistent network-specific separability, whereas chat and email demonstrate greater variability across anonymity-network pairs.
