# Machine-Learning-Based Darknet Traffic Detection System for IoT Applications
## 1 Introduction  
IoT and other communication technologies have dramatically improved our ability to comprehend our environment. Life quality may be improved through the use of IoT technologies, which have the potential to gather and analyze data about the surrounding environment [1]. This circumstance facilitates the development of smart cities by making it easier for things and humans to communicate with each other. There were an estimated 50 billion Internet of Things (IoT) devices by the end of 2020 [2, 3]. The IoT is a sophisticated and interconnected system. As a result, it is difficult to meet the security requirements of an IoT system with a large attack surface. The widespread useof IoT has had the unintended consequence of making IoT deployment an interconnected process. There are a number of considerations to keep in mind while deploying an IoT system: security, energy efficiency, analytics approaches, and interoperability with other software applications [3]. The IoT devices, on the other hand, often operate in the absence of a human operator. These devices can therefore be physically accessed by an intruder. Intruders can gain access to private information via eavesdropping on wireless networks used by IoT devices, which are often connected by a communication channel. As the IoT area continues to evolve, defining a reference architecture that can accommodate both present functionality and future enhancements will be a significant task. As a result, such an architecture must be: scalable, in order to handle a rising number of devices and services without compromising their performance; interoperable, so that devices from different manufacturers may collaborate to accomplish shared objectives; distributive, in order to enable the development of a distributed environment in which data are processed by different entities in a distributed manner after being acquired from various sources; and capable of operating with minimum resources [4]. There is currently no single reference architecture, and building one is proving difficult despite several standardization initiatives. The fundamental issue is the inevitable fragmentation of possible applications, each of which is dependent on a plethora of frequently disparate factors and design standards. This issue must be combined with each supplier's desire to promote its platform for comparable applications [4; 5]. Figure 1 depicts some of the most often seen Internet of Things architectures [5]. Cyber-attacks against IoT devices are increasing in line with their growth, and IoT devices can be tricked into becoming bots that mindlessly obey orders in order to commit crimes as part of a botnet. A botnet is a network of infected devices used by an attacker to carry out tasks such as DDoS attacks, Bitcoin mining [6], and spam email distribution. Almost any internet-connected device may become infected and join a botnet. Because IoT devices have poor security and are thus simple candidates for infection, they are frequently enlisted to become bots. Botnets, like other malware, may be found on Darknet marketplaces. Botnets may be hired, and botnet source codes can be purchased or even leaked, as with the Mirai botnet. Prices range from tens to hundreds of dollars based on the type of service, the number of bots/devices accessible for usage in the botnet, and the power and time of the DDOS attack [7; 8; 9]. Some botnets compete against one another due to the competitive nature of the Darknet. If an IoT device has previously been attacked, another botnet can try to replace the infection with its own program and, in certain situations,  
Figure 1: Most popular IoT architectures. \"fix\" the security issue utilized by the prior botnet to prevent re-infection and maintain its position on the susceptible device. The Dark Web, Deep Web or Darknet describes a network of websites that are open to the public but conceal the servers' IP addresses. Deep Web is expected to be many orders of magnitude larger than surface web [10].