留一服务出评估下的开放世界暗网流量识别
Open-World Darknet Traffic Recognition Under Leave-One-Service-Out Evaluation
浏览论文内容
中文总结 AI 辅助
本文针对暗网流量识别的封闭世界评估不切实际的问题，提出结合留一服务出评估与随机森林、XGBoost及不确定性感知分类的开放世界框架，发现行为重叠是开放世界分类的主要挑战。
中文摘要 AI 辅助
暗网流量识别对网络威胁情报至关重要，因为匿名网络常被用于隐藏恶意活动。然而，现有多数研究依赖封闭世界评估，假设训练和测试阶段所有服务类别均为已知，这在现实环境中并不现实。本文提出一种开放世界暗网流量分类框架，采用留一服务出（Leave-One-Service-Out）评估与结合随机森林（Random Forest）、XGBoost模型的不确定性感知分类方法。实验结果表明，从封闭世界过渡到开放世界设置时，性能会显著下降，说明封闭世界评估大幅高估了部署的鲁棒性：例如，在I2P环境中，XGBoost的Macro-F1值从88.8%降至46.1%，而随机森林的性能从87.4%降至45.7%。尽管基于不确定性的弃权（不执行）机制略微提升了鲁棒性，但已知服务与未知服务间的强行为相似性导致频繁误分类。语义吸收分析进一步显示，FreeNet视频流量以88.1%的分配率被归类为浏览流量，而I2P对等流量以83.4%的分配率被吸收到FTP相关行为中。研究结果表明，行为重叠仍是可靠开放世界暗网流量分类的主要挑战。
英文摘要
Darknet traffic recognition is critical for cyber threat intelligence, as anonymity networks are often used to conceal malicious activity. However, most existing studies rely on closed-world evaluation, assuming all service categories are known during training and testing, which is unrealistic in real-world environments. This paper presents an open-world darknet traffic classification framework using leave-one-service-out evaluation and uncertainty-aware classification with Random Forest and XGBoost models. Experimental results demonstrate significant performance degradation when transitioning from closed-world to open-world settings, demonstrating that closed-world evaluation substantially overestimates deployment robustness. For example, XGBoost Macro-F1 decreases from 88.8% to 46.1% in the I2P environment, while Random Forest performance drops from 87.4% to 45.7%. Although uncertainty-based rejection slightly improves robustness, strong behavioral similarity between known and unknown services leads to frequent misclassification. Semantic absorption analysis further shows that FreeNet video traffic is classified as browsing traffic with an 88.1% assignment rate, while I2P peer-to-peer traffic is absorbed into FTP-related behavior with an 83.4% assignment rate. The findings demonstrate that behavioral overlap remains a major challenge for reliable open-world darknet traffic classification.
