# Machine-Learning-Based Darknet Traffic Detection System for IoT Applications
## 3 System Modeling and Environment
### The Darknet Traffic Dataset  
Darknet, also known as blackhole or sinkhole attacks, are significant, and recent attack vectors were launched against several IoT communication services [51]. Since Darknet address space evolved as a reserved internet address space that is not contemplated to be used by legitimate hosts globally, any communication traffic is speculated to be unsolicited and distinctively deemed a probe, backscatter, or misconfiguration. The main objective of this research is to detect Darknet traffic to combat suspected activities before they assault the cyber world. To address the problem stated in this research, one should first consider collecting a representative traffic dataset that the proposed model can utilize to express the Darknet traffic over the IoT network communications. A CIC-DarkNet-2020 dataset, which was compiled by [PERSON] et al. (2020)[25] and made public by the Canadian center of cybersecurity (CIC), has been utilized in this research. The CIC-DarkNet-2020 dataset is a novel and inclusive dataset that intelligently combines the traffic records of two publicly available datasets, (ISCXVPN2016 and ISCXTor2017 [52]), to produce a comprehensive dataset for Darknet traffic activities covering a wide range of Darknet activities, including VPN and Tor traffic.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Ref** & **Year** & **Technique** & **Contribution** \\ \hline
[37] & 2018 & Multi-Layer Perceptron Neural Network and Wireshark & Building a representative dataset of VPN and non-VPN values and classifying VPN network data \\ \hline
[40] & 2012 & Classification Techniques Mixed With QoS & Real-time classification of Tor’s encrypted circuits by application and assignment of separate service classes to each \\ \hline
[41] & 2020 & Network Flow Features & Multi-level Tor traffic classification and identification framework for both mobile and PC platforms \\ \hline
[43] & 2017 & Decision Tree and TriTraining Algorithm & A hierarchical classification strategy for distinguishing Tor anonymous traffic from mixed traffic \\ \hline
[45] & 2018 & Various Techniques & A thorough analysis of Tor traffic classification, quantification, and comparison of various strategies \\ \hline
[46] & 2021 & Convolution-LSTM and Extreme Gradient Boosting & A generalized strategy for detecting and categorizing Darknet traffic using Deep Learning \\ \hline
[47] & 2021 & ML and Receiver Operating Characteristics & A feature significance analysis for the best classifier of binary and multi-class data \\ \hline
[48] & 2021 & ML and Game-Theoretic Method & Differentiating Darknet traffic from benign traffic using ensemble machine-learning algorithms \\ \hline
[49] & 2021 & Weight-Agnostic Neural Network & Framework for Darknet traffic management for automating the suspicious intent recognition in real time \\ \hline
[50] & 2021 & Convolutional Neural Network & Two-stage, two-label classification system that can recognize both protocols and applications \\ \hline \hline \end{tabular}
\end{table}
Table 3: _Cont._CIC-DarkNet-2020 dataset recorded a total of ~141,530 network traffic records comprising benign traffic (~11,7219) and Darknet traffic (~24,311). Darknet traffic activities are meant to target the desecration of several significant IoT and networking services, including audio/video streaming services (such as YouTube), browsing services (such as Firefox), chatting and VOIP services (such as Skype), email services (such as SMTP), peer-to-peer (P2P) services (such as BitTorrent), and file transfer services (such as FTP). A summary of CIC-DarkNet-2020 dataset distribution using four classes (VPN, TOR, Non-VPN, or Non-TOR), is provided in Figure 4 below [25].