Anonymous traffic classification based on three-dimensional Markov image and deep learning

Abstract

Illegal elements use the characteristics of an anonymous network hidden service mechanism to build a dark network and conduct various illegal activities, which brings a serious challenge to network security. The existing anonymous traffic classification methods suffer from cumbersome feature selection and difficult feature information extraction, resulting in low accuracy of classification. To solve this problem, a classification method based on three-dimensional Markov images and output self-attention convolutional neural network is proposed. This method first divides and cleans anonymous traffic data packets according to sessions, then converts the cleaned traffic data into three-dimensional Markov images according to the transition probability matrix of bytes, and finally inputs the images to the output self-attention convolution neural network to train the model and perform classification. The experimental results show that the classification accuracy and F1-score of the proposed method for Tor, I2P, Freenet, and ZeroNet can exceed 98.5%, and the average classification accuracy and F1-score for 8 kinds of user behaviors of each type of anonymous traffic can reach 93.7%. The proposed method significantly improves the classification effect of anonymous traffic compared with the existing methods.