Machine Learning Classifies Encrypted Darknet Traffic Using Optimized Feature Selection Methods

An evaluation of machine learning architectures combined with automated feature selection techniques has demonstrated that algorithm choice and dimensionality reduction directly determine how effectively security systems identify encrypted darknet network communications. Computer scientists Felix Etyang, Pramod Pavithran, Gideon Mwendwa, Sheenamol Yoosaf, and Ngaira Mandela conducted a comparative benchmark examining three distinct feature selection methodologies—Boruta, Recursive Feature Elimination, and Lasso—across eight supervised machine learning classifiers. Network data gathered from anonymized and encrypted channels presents operational obstacles for intrusion detection systems because packets are intentionally obfuscated to evade surveillance and mimic benign background activities. Analyzing network flows typically requires inspecting hundreds or thousands of packet attributes, many of which introduce statistical noise, increase processing latency, and degrade model generalizability. The researchers sought to systematically assess how pruning redundant input variables influences classification accuracy, computational training runtime, and operational trade-offs across varied algorithmic frameworks.

The underlying data for the investigation was derived from the CIC-Darknet2020 dataset compiled by the Canadian Institute for Cybersecurity, which provides network flow instances split across four core traffic categories: Tor, Virtual Private Networks, Non-Tor, and Non-VPN communications. Within this repository, Tor traffic represents encrypted network flows routed through multiple relay nodes designed to mask user internet protocol addresses and routing topologies to preserve operational anonymity. Virtual Private Network traffic incorporates cryptographic encryption to secure the transmission pathway between client endpoints and internet destinations without concealing endpoint user activity in the manner of multi-node relay systems. Non-Tor and Non-VPN instances represent standard, unencrypted clear-net communications that function as analytical baselines. The raw dataset contained over 1,000 potential extracted features per network transmission packet, encompassing attributes such as source and destination ports, packet lengths, flow durations, inter-arrival timing statistics, and protocol control flags.

To prepare the high-dimensional traffic records for algorithmic modeling, the investigators implemented a multi-stage data preprocessing pipeline. Categorical attributes such as protocol labels were transformed into numerical representations using label encoding to ensure mathematical compatibility across all classifier pipelines. Continuous numerical values were normalized using Min-Max scaling into a standardized range between zero and one, preventing features with large numerical magnitudes from dominating the loss functions during model optimization. To handle computational constraints associated with high-dimensional network data while maintaining class balance, the dataset underwent controlled downsampling designed to preserve the proportionate representation of minority traffic classes. Missing and incomplete feature records were identified and addressed through targeted imputation or deletion based on the distribution and extent of the missing values across the corpus. The resulting cleaned data was divided into training and testing partitions using an eighty-twenty stratified split to preserve identical class distributions across both evaluation partitions.

The benchmark scrutinized three distinct feature selection algorithms designed to isolate informative network attributes from irrelevant packet statistics. Boruta functions as an all-relevant wrapper method based on Random Forest ensembles; it generates synthetic shadow features via random permutations of real attributes, iteratively evaluates feature importance against these randomized benchmarks, and retains features that demonstrate statistically superior predictive significance. In this study, Boruta reduced the initial pool of over 1,000 attributes down to approximately 400 significant features while dynamically adjusting significance thresholds according to shadow feature variance. In contrast, Recursive Feature Elimination operates by iteratively fitting a base estimator, ranking feature importance weights, and recursively removing the least significant features until reaching a specified target subset, paring the feature pool by half to 500 attributes through a weighted elimination mechanism. Meanwhile, the adaptive Lasso technique applies an L1 regularization penalty to the regression coefficients, systematically shrinking coefficients of non-informative variables toward zero and pruning the original 1,000 candidate attributes to approximately 300 non-zero predictors.

To evaluate the downstream effects of each feature selection strategy, the researchers trained eight machine learning algorithms: Logistic Regression, Decision Trees, Random Forest, Support Vector Machines, Gradient Boosting, K-Nearest Neighbors, Naive Bayes, and multi-layer Neural Networks. Hyperparameter optimization was conducted systematically using ten-fold cross-validation with GridSearchCV, supported by random searches when hyperparameter combinations exceeded practical computational bounds. The optimal configuration for Random Forest incorporated 300 trees, a maximum tree depth of 20, and a minimum split requirement of 5 samples. Gradient Boosting achieved optimal configuration with 200 estimators, a learning rate of 0.05, and a maximum tree depth of 5. Support Vector Machines utilized a radial basis function kernel with a regularization parameter of 1 and scaled gamma. The Neural Network was configured as a multi-layer perceptron with two hidden layers of 100 units each, an initial learning rate of 0.01, and rectified linear unit activations. K-Nearest Neighbors selected five neighbors using Euclidean distance, Naive Bayes utilized an additive smoothing alpha of 0.1, and Logistic Regression implemented a regularization strength of 1 using the lbfgs numerical solver.

Establishing initial baselines without feature selection revealed significant disparities in how raw high-dimensional network data impacts different algorithm architectures. Gradient Boosting delivered comparable baseline performance, attaining 97.15 percent accuracy and a 99.51 percent area under the curve. The Neural Network model established a baseline accuracy of 95.62 percent with a 99.01 percent receiver operating characteristic score. Support Vector Machines produced a competitive accuracy of 92.03 percent but incurred severe computational overhead, requiring 1,357.89 seconds of execution time. Conversely, Naive Bayes struggled under the unpruned feature space due to its conditional feature independence assumption, recording an accuracy of only 54.01 percent and an F1-score of 35.77 percent when exposed to correlated and noisy traffic variables.

Integrating Boruta feature selection generated the highest overall classification performance across the benchmark, particularly when paired with ensemble decision trees. When trained on the approximately 400 Boruta-selected attributes, Random Forest reached a peak classification accuracy of 98.7 percent alongside a receiver operating characteristic area under the curve of 99.66 percent. Gradient Boosting matched this discriminative capability by recording an area under the curve of 1.00, demonstrating near-perfect separation between traffic categories. Decision Trees configured with Boruta features achieved 98.12 percent accuracy and a 97.16 percent area under the curve, while the Neural Network model attained 95.83 percent accuracy and a 98.99 percent area under the curve. In confusion matrix assessments, Random Forest correctly classified 1,031 instances of class 1 with minimal false positives or false negatives, and Gradient Boosting correctly identified 1,021 instances. Furthermore, log-transformed statistical significance testing confirmed that Boruta significantly reduced model training duration relative to the unoptimized baseline across paired t-tests (t(7) = 3.66, p = 0.008) and Wilcoxon signed-rank tests (W = 0, p = 0.018).

Recursive Feature Elimination established the fastest computational runtimes among all evaluated methods, highlighting its utility for hardware-constrained or time-sensitive intrusion detection settings. Decision Trees paired with Recursive Feature Elimination completed model training in 0.48 seconds while retaining strong predictive metrics, including 98.2 percent classification accuracy and a 97.39 percent area under the curve. When applied to Random Forest, Recursive Feature Elimination maintained 98.44 percent accuracy and an area under the curve of 99.7 percent, demonstrating that critical predictive structures could be preserved despite removing half of the initial feature pool. Naive Bayes experienced substantial gains under Recursive Feature Elimination, improving its accuracy from the 54.01 percent baseline to 74.09 percent. However, Recursive Feature Elimination degraded linear performance, causing Logistic Regression accuracy to decline noticeably from 88.51 percent to 76.06 percent, which indicated that sequential pruning inadvertently dropped variables essential for linear decision boundaries.

Adaptive Lasso regularized regression provided computational benefits for simpler linear classifiers while demonstrating distinct limitations when applied to non-linear and highly complex model architectures. Under Lasso selection, model training runtimes decreased by approximately 50 percent across several classifiers, such as reducing Logistic Regression execution time from 9.37 seconds down to 4.65 seconds. The most notable performance increase occurred with Naive Bayes, where removing irrelevant linear predictors elevated classification accuracy from 54.01 percent to 77.05 percent. Random Forest retained high predictive reliability under Lasso, registering 95.87 percent accuracy and a 98.69 percent area under the curve. Nevertheless, aggressive coefficient shrinkage harmed complex algorithms by discarding subtle interaction terms, driving Gradient Boosting accuracy down from 97.15 percent to 94.76 percent. In addition, Support Vector Machines failed to gain practical computational efficiency under Lasso, still requiring 735.88 seconds of training time while suffering reduced predictive performance.

Ablation experiments systematically tested feature selection robustness by removing features in ten percent increments, moving progressively from the least critical variables to the most important predictors identified by each method. Classifiers dependent on Boruta-derived attributes experienced rapid, sharp drops in F1-score and receiver operating characteristic metrics as top-ranked features were stripped away, confirming that Boruta isolates concentrated, indispensable predictors critical for darknet traffic discrimination. In contrast, models trained on Lasso-selected features displayed a gradual, linear degradation in performance across successive removal steps, indicating that predictive weight under L1 regularization was dispersed across a broader collection of surviving variables. Stability evaluations employing five-fold stratified cross-validation further established that ensemble architectures like Random Forest and Gradient Boosting maintained narrow interquartile accuracy ranges across separate splits, whereas models like Naive Bayes exhibited wide variations across training partitions.

The study authors documented several operational limitations and threats to validity inherent to the experimental design. Although the CIC-Darknet2020 dataset provides structured representations of Tor, VPN, and clear-net flows, it does not encompass newer decentralized anonymization architectures or emerging tunneling protocols such as I2P, Lokinet, or ZeroNet. Furthermore, the analysis assumed static traffic distributions, whereas real-world darknet actors frequently deploy adaptive obfuscation and adversarial packet modification techniques that can degrade static machine learning models over time. Computationally, although feature selection reduced data dimensionality, ensemble models such as Random Forest and Gradient Boosting still demand substantial computational resources that may restrict real-time deployment on decentralized edge hardware or resource-constrained Internet of Things monitors. In response, the authors outlined future research priorities, emphasizing the need to investigate hybrid feature selection pipelines combining Boruta and Recursive Feature Elimination, develop transformer architectures with self-attention mechanisms, apply model quantization and knowledge distillation, and evaluate model performance within live intrusion detection testbeds.

Subject of Research: Comparative performance analysis of machine learning models and feature selection techniques for darknet traffic classification

Article Title: Performance analysis of machine learning models with optimized feature selection techniques for darknet traffic classification

Article References: Etyang, F., Pavithran, P., Mwendwa, G., Yoosaf, S., & Mandela, N. (2026). Performance analysis of machine learning models with optimized feature selection techniques for darknet traffic classification. Discover Computing, 29(1), Article 836. https://doi.org/10.1007/s10791-025-09652-9

Image Credits: AI Generated

DOI: 10.1007/s10791-025-09652-9

Keywords: Darknet Traffic Classification, Machine Learning, Feature Selection, Boruta Algorithm, Recursive Feature Elimination, Lasso Regularization, Random Forest, CIC-Darknet2020 Dataset, Encrypted Network Traffic, Cybersecurity, Gradient Boosting, Decision Trees, Network Anomaly Detection, Computational Efficiency, Model Interpretability, Support Vector Machines, Naive Bayes, Tor Network, Virtual Private Networks