DGNN: Accurate Darknet Application Classification Adopting Attention Graph Neural Network

Abstract

Encrypted communications, implemented for the confidential information exchange, facilitate the preservation of individual privacy. Unfortunately, some criminals abuse encrypted communications to conduct illegal activities, leading to the proliferation of the Darknet. To curb malicious darknet activities, the accurate and effective classification of darknet traffic is imperative. Considerable endeavors have been devoted to identifying the darknet traffic. However, the classification of darknet applications has not yielded a satisfactory result. This deficiency arises from the limitations of current approaches, e.g., some traditional methods rely on hand-crafted features that consume labor, and other neural network-based methods disregard the graph structure of the traffic. To tackle these challenges, we propose the Darknet Traffic Graph (DTG), a graph structure that captures the interactions between local clients and remote servers in darknet traffic. Furthermore, based on DTG, we combine the GNN model and attention mechanism to create the Darknet Graph Neural Networks, i.e., DGNN, a powerful model that sufficiently exploits the benign and darknet traffic features. As a result, on the CIC-Darknet2020 dataset, the accuracy of DGNN in traffic classification and application classification is 98.52% and 99.06%, respectively, which outperforms other classifiers.