# Machine-Learning-Based Darknet Traffic Detection System for IoT Applications
## 3 System Modeling and Environment
### Feature Engineering Unit  
Feature engineering is the selection, manipulation, and transformation of raw data into attributes that may be fed into the machine-learning algorithms for further processing, training, validation, and prediction using a pipeline of preprocessing stages started at the data accumulation process. Our feature engineering unit performs the following consecutive preprocessing operations before the data reach the learning models:  
* Data Presentation: CIC-DarkNet-2020 dataset is initially available in CSV format. Therefore, to be processed by the MATLAB platform, at the outset, it should be  
Figure 4: CIC-DarkNet-2020 dataset sample distribution.  
Figure 3: System development model diagram for proposed Darknet-IDS of IoT (DTDS-IoT) network traffic via ML techniques.  
imported from the CSV file and presented as a table of data records in the MATLAB tables with named columns and numbered rows.
* Exploratory data analysis (EDA): EDA of the dataset performs vital data curation tasks to gain a deeper insight into the dataset. Such a process completes a preliminary enhancement process of the dataset by checking missing data values and providing proper substitution for the missed records, replacing null values with appropriate replacements, such as zeroes, visualizing the dataset classes' histogram to gain more insights into the classes and features.
* Feature Selection: Datasets are comprised of several features with diverse datatypes. Nevertheless, not all features can be considered for machine-learning models, since they can either be unlearnable (such as string features) or might have a negative impact on the classifier performance. The coefficient score approach is employed to extract the most influential features of the CIC-DarkNet-2020 dataset to obtain the best features that can be used later in training and validating the learning models.
* Data Normalization: normalization is usually performed over the scattered data points with a significant range between the points. Therefore, normalization is performed in order to re-scale data points to be in the same range and significance (usually 0-1). This will disallow the larger values from dominating other data points in the dataset. Therefore, we apply min-max normalization at the stage of preprocessing to have all numerical data within a range between 0 and 1. The min-max normalization of a datapoint \(D_{i}\) within a set of points (\(D\)), is given by the following formula (\(D_{i}^{Norm}\)): \[D_{i}^{Norm}=\frac{[D_{i}-\text{min}(D)]}{[\text{max}(D)-\text{min}(D)]}\] (1)
* Label Encoding: Label encoding techniques are utilized to convert categorical data into numerical data that may be processed by machine-learning methods.
* This research employed integer encoding techniques to represent the categorical data as a numerical record. For instance, the output class labels were encoded as [non-Tor: 00, non-VPN: 01, Tor: 02, and VPN: 03].
* Data Shuffling: The shuffling process is a preprocessing operation conducted over the dataset samples (rows) by randomly rearranging data from a dataset to produce a new arrangement for the dataset that can be safely used for ML testing and training, without having the classifier being biased to any of the underlying classes. This will guarantee anonymity while ensuring data statistics are kept exactly the same. Figure 5 illustrates the data shuffling process.
* Folding and Splitting: To ensure a high level of the validation process of the proposed predictive models, we have conducted a k-fold cross-validation operation incorporating five different folds (distributions) with data split into 70% for training and 30% for validation (testing). For every fold, a new validation experiment involves further data distribution to ensure that all data items have participated in the training and validation process. Our folding and splitting process is shown in Figure 6 and depicts the dataset distribution throughout the folds for each experiment.