Nearest Neighbor Based Flow-Data Augmentation and Group Voting for Darknet Traffic Detection
摘要
With the rapid advancement of network technologies, darknet traffic has become a common channel for various illegal activities. Identifying darknet traffic and understanding the underlying user behaviors have become as critical challenges in the field of cybersecurity. Existing methods for darknet traffic detection largely focus on individual flows, neglecting the potential interdependencies between different flows. In this paper, we propose a novel approach for darknet traffic detection that combines nearest-neighbor flow data augmentation with a group voting mechanism, applicable to any flow-based darknet detection method. In the data processing phase, we utilize the nearest-neighbor algorithm to aggregate similar flow features, creating new samples and addressing the class imbalance inherent. Additionally, in the test phase, we introduce a weighted group voting mechanism based on neighborhood samples to predict the traffic type. This mechanism accounts for the relationships between neighboring flows, reducing the uncertainty of individual predictions and improving both model robustness and generalization performance. Experimental results demonstrate that the proposed method excels across multiple darknet datasets, achieving an average improvement of 2.3% in accuracy and 2.7% in F1-score.