Search papers, labs, and topics across Lattice.
This study introduces an open-world darknet traffic classification framework that employs leave-one-service-out evaluation and uncertainty-aware classification techniques using Random Forest and XGBoost models. The research highlights the significant performance drop when moving from closed-world to open-world scenarios, with XGBoost Macro-F1 scores plummeting from 88.8% to 46.1% in the I2P environment, underscoring the inadequacy of closed-world evaluations in assessing real-world robustness. Additionally, the analysis reveals that high behavioral similarity between known and unknown services leads to frequent misclassifications, posing a substantial challenge for effective darknet traffic recognition.
Transitioning to open-world evaluation reveals that closed-world models can drastically overestimate their effectiveness, with performance dropping by over 40% in real-world scenarios.
Darknet traffic recognition is critical for cyber threat intelligence, as anonymity networks are often used to conceal malicious activity. However, most existing studies rely on closed-world evaluation, assuming all service categories are known during training and testing, which is unrealistic in real-world environments. This paper presents an open-world darknet traffic classification framework using leave-one-service-out evaluation and uncertainty-aware classification with Random Forest and XGBoost models. Experimental results demonstrate significant performance degradation when transitioning from closed-world to open-world settings, demonstrating that closed-world evaluation substantially overestimates deployment robustness. For example, XGBoost Macro-F1 decreases from 88.8% to 46.1% in the I2P environment, while Random Forest performance drops from 87.4% to 45.7%. Although uncertainty-based rejection slightly improves robustness, strong behavioral similarity between known and unknown services leads to frequent misclassification. Semantic absorption analysis further shows that FreeNet video traffic is classified as browsing traffic with an 88.1% assignment rate, while I2P peer-to-peer traffic is absorbed into FTP-related behavior with an 83.4% assignment rate. The findings demonstrate that behavioral overlap remains a major challenge for reliable open-world darknet traffic classification.
