Gradient Boosting 기법을 활용한 다크넷 트래픽 탐지 및 분류 = Darknet Traffic Detection and Classification Using Gradient Boosting Techniques

다국어 초록 (Multilingual Abstract)

Darknet is based on the characteristics of anonymity and security, and this leads darknet to be continuously abused for various crimes and illegal activities. Therefore, it is very important to detect and classify darknet traffic to prevent the misuse and abuse of darknet. This work proposes a novel approach, which uses the Gradient Boosting techniques for darknet traffic detection and classification. XGBoost and LightGBM algorithm achieve detection accuracy of 99.99%, and classification accuracy of over 99%, which could get more than 3% higher detection accuracy and over 13% higher classification accuracy, compared to the previous research. In particular, LightGBM algorithm could detect and classify darknet traffic in a way that is superior to XGBoost by reducing the learning time by about 1.6 times and hyperparameter tuning time by more than 10 times.

참고문헌 (Reference)

1 김지혜, "주성분 분석과 머신러닝 기법을 활용한 Tor 네트워크 웹사이트 핑거프린팅 연구" 국방보안연구소 3 (3): 7-44, 2021

2 Github, "ipinfo/python"

3 Tianqi Chen, "XGBoost: A Scalable Tree Boosting System" 785-794, 2016

4 Ferguson, Paul, "What is a VPN?"

5 TrendMicro, "What We Know About the Darkside Ransomware and the US Pipeline Attack"

6 UNB(University of New Brunswick), "VPN-nonVPN dataset (ISCXVPN2016)"

7 P. Gao, "VPN Traffic Classification Based on Payload Length Sequence" IEEE Computer Society 241-247, 2020

8 Dingledine, "Tor: The second-generation onion router" Naval Research Lab Washington DC 2004

9 UNB(University of New Brunswick), "Tor-nonTor dataset (ISCXTor2016)"

10 Jessica A. Wood, "The Darknet: A Digital Copyright Revolution" 16 : 14-, 2010

11 Shwartz-Ziv, Ravid, "Tabular data: Deep learning is not all you need" 81 : 84-90, 2021

12 Nitesh V. Chawla, "SMOTE: synthetic minority over-sampling technique" 16 (16): 321-357, 2002

13 LightGBM, "LightGBM Features"

14 Towards Data Science, "How to choose between different Boosting Algorithms"

15 VPNPROCLUB, "How To Use VPN For Dark Web"

16 iTechHacks, "How To Use Deep/Dark Web On Your Android (A-Z Guide On Deep Web)"

17 Machine Learning Mastery, "Gradient Boosting with Scikit-Learn, XGBoost, LightGBM, and CatBoost"

18 Neha Gupta, "Encrypted Traffic Classi fication Using eXtreme Gradient Boosting Algorithm" Springer 1394 : 225-232, 2019

19 Iliadis, "Darknet Traffic Classification using Machine Learning Techniques" 1-4, 2021

20 M. B. Sarwar, "DarkDetect: Darknet Traffic Detection and Categorization Using Modified Convolution-Long Short-Term Memory" 9 : 113705-113713, 2021

21 Arash Habibi Lashkari, "DIDarknet : A Contemporary Approach to Detect and Characterize the Darknet Traffic using Deep Image Learning" ACM 1-13, 2020

22 Florian Platzer, "Critical traffic analysis on the tor network" 1-10, 2020

23 Lashkari, A. H., "Characterization of tor traffic using time based features" 2 : 253-262, 2017

24 Draper-Gil, G., "Characterization of encrypted and vpn traffic using time-related" 2 : 407-414, 2016

25 Github, "CICFlowMeter"

26 UNB(University of New Brunswick), "CIC-Darknet2020"

27 Cyberint, "Avaddon Ransomware Attack Hits AXA Philippines, Malaysia, Thailand and Hong Kong"

28 Boannews, "A large-scale of login attempts happened by abusing the leaked Kakaotalk account"

29 Li, Cheng, "A gentle introduction to gradient boosting"