# Machine-Learning-Based Darknet Traffic Detection System for IoT Applications
## 3 System Modeling and Environment
### Learning Models Unit  
The learning process is a practice of applying algorithmic models to data in an iterative manner to enable the machine (such as a computer) to discover hidden patterns that it can use to make predictions. A large number of supervised machine-learning algorithms are usually employed to build models to address three common tasks: regression, prediction, and classification [53; 54; 55]. As our DTDS problem is modeled as a classification problem, we have used and implemented six different supervised machine-learning methods, including bagging decision tree ensembles (BAG-DT), AdaBoost decision tree ensembles (ADA-DT), RUSBoosted decision tree ensembles (RUS-DT), optimizable decision tree (o-dt), optimizable k-nearest neighbor (O-KNN), and optimizable discriminant (O-DSC). A summary of specifications and configurations for the implemented machine-learning models is pro vided in Table 4. After that, the developed model undergoes an evaluate-and-compare (E and C) process to pick up the best (optimum) ML technique to model the problem of DTDS. To do so, the classification accuracy metric is evaluated for each model and used as a vital metric to compare the developed models and select the best optimized model to be employed to address the Darknet traffic detection and classification task. The performance accuracy is used as a unified performance metric by which we might be able to provide some insights about developed methods and help select the best ML-based solution for this specific problem.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**ML Model** & **Specifications** \\ \hline \multirow{2}{*}{BAG-DT} & Preset: Bagged Trees, Ensemble method: Bag, Learner type: Decision tree, Maximum number of splits: 89161, \\  & Number of learners: 30, Data Distribution Policy: 70\% training and 30\% testing, 5-Fold Cross-Validation. \\ \hline \multirow{2}{*}{ADA-DT} & Preset: Boosted Trees, Ensemble method: AdaBoost, Learner type: Decision tree, Maximum number of splits: 20, \\  & Number of learners: 30, Learning rate: 0.1, Data Distribution Policy: 70\% training and 30\% testing, 5-Fold Cross-Validation. \\ \hline \multirow{2}{*}{RUS-DT} & Preset: RUSBoosted Trees, Ensemble method: RUSBoost, Learner type: Decision tree, Maximum number of splits: 20, Number of learners: 30, Learning rate: 0.1, Data Distribution Policy: 70\% training and 30\% testing, 5-Fold Cross-Validation. \\ \hline \multirow{2}{*}{O-DT} & Preset: Fine Tree, Maximum number of splits: 100, Split criterion: Gini’s diversity index, Surrogate decision splits: \\  & On, using a maximum of 10 surrogates, Data Distribution Policy: 70\% training and 30\% testing, 5-Fold Cross-Validation. \\ \hline \multirow{2}{*}{O-KNN} & Preset: Optimizable KNN, Number of neighbors: 2, Distance metric: Euclidean, Distance weight: Squared inverse, \\  & Standardize data: false, Optimizer: Bayesian optimization, Acquisition function: Expected improvement per second \\  & plus, Iterations: 30. \\ \hline \multirow{2}{*}{O-DSC} & Preset: Optimizable Discriminant, Discriminant type: Linear, Quadratic, Diagonal Linear, Diagonal Quadratic, \\  & Optimizer: Bayesian optimization Acquisition function: Expected improvement per second plus, Iterations: 30, \\ \hline \hline \end{tabular}
\end{table}
Table 4: Learning model specifications and configurations.  
Figure 5: Data shuffling process illustration.  
Figure 6: Scheme for the folding and splitting of the dataset used in the proposed system.