RNN-LSTM Based Deep Learning Model for Tor Traffic Classification

ABSTRACT Tor is an anonymous browser software running on an overlay network. Due to the nature of the end-to-end encryption channel, it is hard to analyse the network traffic. Thus, intruders prefer the Tor browser to hide their identity and access the offensive content. Tor relays are secure from network monitoring, tracking and surveillance. There are so many research contributions for tracking the network traffic and classifying it based on various features and attributes. In this paper, we explained RNN-LSTM-based deep learning model to classify the network traffic based on their nature Tor/non-Tor. We have tested the model with open data sets ISCXTor2016 data sets and samples retrieved in our environment using CIC-flowmeter-4.0. The binary classification model using RNN-LSTM classifies the network traffic with better accuracy and precision. The same experiment conducted in the traditional deep neural network model provides large false positives and false negatives. Here we also present a detailed study and analysis of the model compare with ANN classifiers and genetic-based feature selection method.