The performance of the proposed model is demonstrated through extensive experiments using the CIC-Darknet-2020 dataset. A two-layered autoencoder-based defence mechanism consisting of a detector and denoiser is devised to increase the robustness of the network security system against adversarial attacks.

This work proposes a Stacking Ensemble (SE) model to combine the predictions of three base learners, 1) Random Forest, 2) K-Nearest Neighbors, and 3) Decision Tree in the most efficient way for improving the overall performance of darknet characterization. Additionally, ML/DL models used in such tasks are susceptible to adversarial perturbed samples that can cause the network security solution to malfunction. Darknet classification models based on Machine Learning / Deep Learning (ML/DL) usually demonstrate high False Positive Rate (FPR) and lower F1-score which are essential metrics for network traffic analysis. The ability to detect, identify, and characterize darknet traffic is critical for detecting network traffic generated by a cyber-attack. Finally, we compare CoDA with an existing public Dark Web dataset and evaluate their suitability for various use cases.Įncrypted traffic tunnelled by Tor or VPN is referred to as darknet traffic.

We also assess the performance of various methods of Dark Web page classification. By leveraging CoDA, we conduct a thorough linguistic analysis of the Dark Web and examine the textual differences between the Dark Web and the Surface Web. This paper introduces CoDA, a publicly available Dark Web dataset consisting of 10000 web documents tailored towards text-based Dark Web analysis. However, not much work has been done to uncover the linguistic characteristics of the Dark Web. Previous works on text classification of Dark Web domain have suggested that the use of deep neural models may be ineffective, potentially due to the linguistic differences between the Dark and Surface Webs. The hidden nature and the limited accessibility of the Dark Web, combined with the lack of public datasets in this domain, make it difficult to study its inherent characteristics such as linguistic properties. We consider that our new algorithm, the extended dataset, and the findings obtained from the analysis carried out are helpful for LEAs to fight against crimes that take place in the Tor hidden services. We also discovered that domains related to suspicious activities usually present multiple clones under different addresses, what could be used as an additional feature for identifying them. The analysis of DUTA-10K reveals that only 20% of the hidden services that can be accessed are related to suspicious activities, and 48% are associated with normal ones. Results showed that our proposal obtains a higher harm to the Tor network robustness than all of them, what indicates its superiority for this problem. We quantitatively compared ToRank with some of the most popular ranking algorithms, like PageRank, HITS, and Katz. We also thoroughly analyze the content present in Tor, creating a dataset, DUTA-10K, that extends the previous Darknet Usage Text Address (DUTA) dataset. In this paper, we propose a new algorithm, named ToRank, that ranks hidden services in Tor better than the known algorithms used for the Surface Web. Law Enforcement Agencies need to monitor and to investigate crimes hidden behind the anonymity provided by Tor. The Tor network hosts a significant amount of hidden services related to suspicious activities.

Central park onion tor