Integrating geolocation intelligence with ensemble machine learning models for enhanced darknet traffic classification

This study presents an innovative approach to darknet traffic classification, combining advanced machine learning techniques with hybrid LASSO-random forest (HLRF) feature selection and IP geolocation mapping. We propose a new ensemble model that significantly outperforms traditional classifiers, achieving an accuracy of 96.86% and an F1-score of 96.12%. Our research utilises an enhanced version of the CIC-Darknet2020 dataset, augmented with additional darknet traffic collected over a six-month period. The HLRF selector is employed to identify the most relevant features, improving the model's efficiency and interpretability. Furthermore, we incorporate IP geolocation mapping to provide insights into the global distribution of darknet activities. Our findings demonstrate the effectiveness of our ensemble method with HLRF feature selection in capturing complex darknet traffic patterns and highlight the challenges in geographical attribution due to sophisticated anonymisation techniques. This work contributes to the field of cybersecurity by offering an improved method for darknet traffic classification and providing a deeper understanding of the global nature of darknet operations.