Advanced Darknet Traffic Detection through Minority-Class Augmentation and Multi-Model Fusion

The Tor network is an anonymous communication technology that can protect user privacy and break through network censorship, but it can also be used by malicious actors and is a focus of network security research. Because its traffic is encrypted multiple times and is similar to ordinary traffic in some characteristics, traditional rule-based matching or anomaly detection methods are difficult to accurately distinguish, resulting in high false positive and false negative rates. To address this problem, this paper proposes an anonymous traffic detection method that combines data enhancement and ensemble learning. Logarithmic transformation, quantile truncation and normalization methods are used for data processing, and minority class samples are supplemented based on data enhancement strategies to alleviate the data imbalance problem, and its impact is evaluated through visualization. This paper constructs an ensemble learning framework based on LightGBM and RandomForest, and uses the Soft Voting strategy to fuse classifier prediction results, significantly improving detection accuracy and stability. Experiments on the CIC-Darknet2020 dataset show that the model can effectively improve the accuracy of anonymous traffic detection, has good stability, and plays a positive role in optimizing the performance of existing network traffic classification models.