FXBoost: darknet user behavior classification based on two-stage ensemble learning

The darknet cannot be searched through regular search engines and can only be accessed through special browsers. Its characteristics of being difficult to track and identify make it challenging for administrators to regulate activities on the darknet. To better regulate activities on the darknet, many researchers use machine learning-based methods to classify and identify darknet traffic. Current research on the darknet mainly focuses on Tor, with insufficient study on other darknet traffic. To conduct a more comprehensive study of darknet traffic, we use machine learning methods to research three types of darknet: Tor, I2P, and Zeronet. For machine learning methods, feature selection and classifier parameter optimization are key factors affecting the performance of the classifier. We have improved the feature selection methods and the classifier parameter optimization process, proposing a model named FXBoost. Comparing this model with previous machine learning methods, we found that our proposed FXBoost model has better classification effects on user behavior in darknet traffic on the same dataset. The accuracy of classifying user behavior in Tor traffic has increased by 7%, by 2.5% in I2P traffic, and by 1.2% in Zeronet traffic.