Darknets facilitate sophisticated cyber threats, but their encrypted, noisy traffic presents significant challenges, including multi-label complexity (e.g., overlapping threat categories and intricate label correlations), severe class imbalance, and dynamic traffic patterns. Traditional machine learning methods often fail to address these nuances effectively. This paper introduces a proposed hybrid LSTM-CNN model tailored for the Darknet2020 dataset, combining sequential (LSTM) and spatial (CNN) feature extraction to capture both temporal dependencies and hierarchical patterns, improving multi-label discrimination. The proposed model specifically addresses label correlation and class imbalance through dual-task learning and synthetic oversampling, enabling robust discrimination of co-occurring threats. The novel preprocessing pipeline mitigates noise and imbalance through adaptive filtering, while the dual-network architecture enhances robustness against label correlation. The model achieves 99% primary label accuracy and 86% secondary label accuracy, outperforming baselines by 11–17%, demonstrating its potential for real-world darknet threat detection.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Addressing Challenges in Darknet2020: Enhancing Multi-Label Classification with LSTM-CNN

  • Nada Salaheddin Gheriyani,
  • Ayad Ali Keshlaf,
  • Juma Ibrahim

摘要

Darknets facilitate sophisticated cyber threats, but their encrypted, noisy traffic presents significant challenges, including multi-label complexity (e.g., overlapping threat categories and intricate label correlations), severe class imbalance, and dynamic traffic patterns. Traditional machine learning methods often fail to address these nuances effectively. This paper introduces a proposed hybrid LSTM-CNN model tailored for the Darknet2020 dataset, combining sequential (LSTM) and spatial (CNN) feature extraction to capture both temporal dependencies and hierarchical patterns, improving multi-label discrimination. The proposed model specifically addresses label correlation and class imbalance through dual-task learning and synthetic oversampling, enabling robust discrimination of co-occurring threats. The novel preprocessing pipeline mitigates noise and imbalance through adaptive filtering, while the dual-network architecture enhances robustness against label correlation. The model achieves 99% primary label accuracy and 86% secondary label accuracy, outperforming baselines by 11–17%, demonstrating its potential for real-world darknet threat detection.