Darknet Traffic and Application Classification Using Heterogeneous Graph Neural Network

The internet is a global system that links millions of computers and digital devices together, enabling communication and information exchange across the world. A key service on the internet is the World Wide Web, which is a vast collection of interconnected pages containing text, images, and videos, accessed online. The Web relies on key components: web pages (documents written in a special code), hyperlinks (which enable navigation between pages), and web servers (computers that host and deliver these pages). In contrast, the Deep Web is a hidden part of the internet that standard search engines like Google cannot access, containing private data such as bank records, medical history, and government files not intended for public viewing [1].

In contrast, the Dark Web constitutes a part of the internet accessible solely through specialized software like the Tor browser, characterized by its anonymity. Infamous for its association with illicit activities, it serves as a marketplace for illegal transactions, including drugs, weaponry, and stolen data, and facilitates the exchange of prohibited information and materials [2]. The proliferation of encrypted and anonymized network traffic, largely driven by the widespread use of privacy-enhancing technologies (PETs) like Tor and VPNs, has created a formidable challenge for modern cybersecurity operations [3, 4]. While these technologies serve legitimate privacy needs, their infrastructure also forms the backbone of Darknets, which are increasingly exploited for illicit activities such as coordinated hacking campaigns, espionage, and the deployment of advanced persistent threats (APTs). Consequently, the accurate and efficient classification of Darknet traffic has become a critical imperative for enabling proactive cyber threat intelligence and strengthening national and organizational security postures.

The expansion of the Internet has transformed global communication, enabling individuals to interact across borders with an Internet connection. The Tor network is a technology that provides users with privacy and anonymity online. It was developed by a team of mathematicians and computer experts based at the Naval Research Laboratory (NRL) in response to concerns about privacy and anonymity during the early stages of the Internet’s development [5].

The Tor network uses a technique called onion routing to route traffic through multiple servers and encrypts it, making it nearly impossible for anyone to trace the user’s online activities [3, 6]. Despite its importance, the task of Darknet traffic classification is fraught with inherent difficulties. The very nature of anonymity tools is to obfuscate traffic patterns and payload content, rendering traditional deep packet inspection (DPI) methods ineffective. While machine learning (ML) approaches that rely on flow-based statistical features have shown more promise, they often exhibit critical limitations [7, 8]. These methods typically treat traffic flows as independent, isolated instances, failing to capture the complex relational structures and temporal dependencies that exist between communication nodes in a network [9]. This inability to model the underlying graph-like nature of network data, where connections between IP addresses, sessions, and protocols contain vital discriminative information, results in suboptimal accuracy, limited generalizability, and poor scalability to the vast volumes of traffic generated in real-world Darknet environments [10].

To bridge this gap, we propose a Darknet Heterogeneous Graph Neural Network (DHGNN) framework. The core innovation of our approach is the reformulation of the traffic classification problem from a tabular learning task to a graph learning task. By constructing a heterogeneous graph that represents various network entities (e.g., hosts, packets, services) and the rich relationships between them, our DHGNN model can directly learn from the topological structure of the network traffic. This allows the model to discern subtle, relational fingerprints of different applications and services that are invisible to conventional classifiers [11, 12]. The proposed method offers significant advantages, including enhanced classification accuracy by leveraging multi-relational data, inherent scalability for large-scale network analysis, and a more nuanced understanding of network behavior.

To validate our approach, we utilize the comprehensive CIC-Darknet2020 dataset [13], a benchmark containing labeled traffic from Tor, VPN, and non-VPN applications. Our methodology involves a rigorous feature analysis to inform the graph construction process, followed by a data preprocessing pipeline that transforms raw tabular traffic data into a structured heterogeneous graph. The experimental results demonstrate that our DHGNN classifier achieves superior performance, outperforming previous state-of-the-art traffic classifiers and confirming the efficacy of graph-based learning for tackling the complexities of Darknet traffic analysis.

The rest of this paper is organized as follows: Section II provides a summary of the relevant literature and prior research in the field. Section III covers the basics of Heterogeneous Graph Neural Networks, such as graph data construction, heterogeneous message passing, and model architecture. Section IV presents the proposed methodology, encompassing the description of the CIC-Darknet2020 dataset, data exploration and preprocessing, as well as the model design. Section V provides the experimental results for both traffic and application classification scenarios. Following this, Section VI is dedicated to the conclusion and suggestions for future research directions.

Heterogeneous Graph Neural Networks (HGNNs) are designed to process graph-structured data consisting of multiple node and edge types, allowing the model to capture complex relational semantics across diverse entities [27]. The presence of such heterogeneous node and edge categories is what distinguishes heterogeneous graphs from their homogeneous counterparts [28].

The HeteroGNN algorithm effectively captures the complex and rich relationships present in such data [29], making it useful for various tasks like node-level classification, link prediction, and graph-level classification across various domains, including social networks, knowledge graphs, and malware detection [30].

3.1 Graph data construction

This phase is foundational, involving the translation of raw network traffic data into a format that a GNN can process. Consider a heterogeneous graph $G=(V, E)$, where V denotes the set of nodes and E denotes the set of edges [31].

• The node set V is categorized into two subsets, $V=V_h \cup V_f$, with V_h being the host nodes and V_fthe flow nodes.
• Host nodes have feature $X_h \in$, and flow nodes have feature matrix $X_f \in R^{\left(\left|v_f\right| \times d_f\right)}$, where d_h and d_f represent the feature dimensions for host and flow nodes, respectively. These features serve as the input to the HGNN [29].
• Identify the relationships or connections between nodes that will be represented as edges. We consider that the edge set E is divided into two different types of flow and host $E=E_h \cup E_f$, where E_hf are edges from host to flow nodes, and E_fh are edges from flow to host nodes. This distinction is crucial for heterogeneous graphs where different types of nodes and edges may encode distinct kinds of information and relationships.

3.2 Heterogeneous message passing

The core of the HGNN algorithm is the heterogeneous message passing mechanism, which updates node embeddings by aggregating information from neighboring nodes across different types [31, 32]. This can be formalized as follows for a two-node-type system using Heterogeneous Graph Convolution (HConv).

For E_hf edges, the update rule for flow node features is:

$H_f^{(l+1)}=\sigma\left(W_{h f}^{(l)} \cdot A G G\left(\left\{h_h^{(l)} \mid \forall\left(v_h, v_f\right) \in E_{h f}\right\}\right)\right)$             (1)

For E_fh edges, the update rule for host node features is:

$H_h^{(l+1)}=\sigma\left(W_{f h}^{(l)} \cdot A G G\left(\left\{h_f^{(l)} \mid \forall\left(v_h, v_f\right) \in E_{f h}\right\}\right)\right)$              (2)

Here, $H_f^{(l+1)}$ and $H_h^{(l+1)}$ denote the embeddings for flow and host nodes at layer l.

$W_{h f}^{(l)}$ and $W_{f h}^{(l)}$ are the learnable weights for each edge type, σ represents a non-linear activation function, and AGG denotes an aggregation function, and their role in combining information from a node’s neighborhood:

(1) Mean Aggregation:

$A G G_{\text {mean }}=\operatorname{mean}\left(H\left[v_i\right],\left(\forall\left(v_i, v_j\right) \in E\right)\right)$              (3)

(2) Sum Aggregation:

$A G G_{\text {sum }}=\operatorname{sum}\left(H\left[v_i\right],\left(\forall\left(v_i, v_j\right) \in E\right)\right)$              (4)

3.3 Model architecture

The model consists of L HConv layers, where the node embeddings are iteratively updated [31, 33]. Initially:

$H_h^{(0)}=X_h$ and $H_f^{(0)}=X_f$              (5)

After L layers, the embeddings for flow nodes, $H_f^{(L)}$, are used in a linear prediction layer:

$Y=W_{\text {out }} \cdot H_f^{(L)}+b_{\text {out }}$               (6)

$Y \in \mathbb{R}^{\left|V_f\right| \times C}$ represents the logits for C classes for each flow node, with W_out and b_out being learnable parameters.

The multi-layer structure with L HConv layers allows for progressively complex feature extraction and representation learning. The transition from initial node features to final embeddings capable of supporting classification tasks illustrates the model’s capability to transform raw data into actionable insights. Finally, the model is optimized via supervised learning, minimizing the cross-entropy loss between the predicted scores Y and the true labels Y_True:

$L=-\sum_i \sum_C Y_{\text {True, ic }} \cdot \log \left(Y_{\text {ic }}\right)$               (7)

Here, I index over flow nodes, and c over classes.

The parameters (W_out, $W_{f h}^{(l)}, W_{h f}^{(l)}$, and b_out) are optimized to minimize L using gradient-based optimization techniques such as Adam, Adamax, AdaGrad, and RMSProp.

The model consists of 7 HeteroGNN layers with a hidden dimension of 64. Host node features Xh and flow node features Xf are embedded into 32 and 11 dimensions, respectively. Each HeteroGNN layer uses SAGEConv with mean aggregation and LeakyReLU activation. The final flow node embeddings are passed through a linear output layer with softmax activation for classification.

In the DHGNN classifier, we’ll set up four or eight layers of SAGEConv with LeakyRELU for each node type (four layers in the case of traffic classification and eight layers in the case of application classification). Then, a linear layer will produce a four or eight-dimensional vector, with each dimension representing a class. Additionally, we’ll train this model in a supervised manner utilizing cross-entropy loss and the Adam optimizer. Next, we specify the heterogeneous GNN, incorporating three parameters: the count of hidden dimensions, the count of output dimensions, and the number of layers.

Hyperparameters optimization for GNN classifiers is crucial, given that it directly affects the model’s classification accuracy. Our experiments, detailed in Table 3, thoroughly explore key parameters, assessing accuracy within defined ranges. We find that a network depth of seven layers, trained over 100 epochs with the Adam optimizer and the LeakyReLU activation function, is the ideal configuration.

In the following subsections, we will present results for both traffic classification and application classification scenarios.

Table 3. DHGNN model hyperparameters and exploration range

5.1 Traffic classification (case of 4 classes)

Our focus was primarily on the initial layer of the CIC-Darknet2020 dataset, which included two primary classes, VPN/Tor Darknet traffic and Non-VPN/Non-Tor benign traffic. The four classes are represented by the pie chart shown in Figure 2, where the counts of each value are as follows: “Non-Tor”: 93309, “Non-VPN”: 23861, “VPN”: 22919, and “Tor”: 1392 occurrences. We assess the performance of the proposed approach using Precision, Recall, F1-score, and Accuracy evaluation metrics.

In traffic classification, the accuracy of our DHGNN model is 99.80%, indicating a very high level of correct predictions. A plot of training loss and validation loss while training the model is shown in Figure 3.

Figure 2. Proportion of each class in the CIC-Darknet2020 dataset – Traffic case

Figure 3. Model’s loss as a function of an epoch during the training process – Traffic case

A plot of the proportion of misclassified samples is given in Figure 4. If we compare this pie chart to the original proportions in the dataset, we see that the model performs better for the majority classes. This is not surprising since minority classes are harder to learn (fewer samples), and not detecting them is less penalizing (with 93309 Non-Tor flows versus 1392 Tor). NonVPN and VPN detection could be improved with techniques such as oversampling and introducing class weights during training.

An analysis of the confusion matrix presented in Figure 5 indicates that the classifier exhibits exceptionally high discriminatory power. The model's performance is characterized by misclassification rates that remain predominantly below 0.5% across all four defined anonymity categories. Despite this robust performance, two specific confusion patterns are discernible. The most significant occurs between Tor and NonVPN traffic, where approximately 10 Tor samples (0.45%) were misclassified. This is likely attributable to overlapping statistical patterns when Tor circuits encapsulate traffic resembling normal encrypted sessions, a challenge compounded by the relatively lower number of Tor samples (n = 121). A second, minor pattern involves a handful of Non-Tor samples being confused with NonVPN and VPN classes (≤ 4 samples each, < 0.2%), potentially stemming from similar feature distributions like packet lengths and timing in various encrypted streams. Overall, the model performs remarkably well, but the Tor vs. NonVPN distinction remains challenging, primarily due to their similar traffic patterns and the imbalance between classes.

Figure 4. Proportion of each misclassified class – Traffic case

Figure 5. Confusion matrix for multi-class flow classification – Traffic case

Table 4 compares the performance of various graph neural network (GNN) models, including ResNet, GIN, GCN, GAT, GraphSAGE, RevGNN, DGNN, and the proposed DHGNN model, on a traffic classification task. The performance metrics reported are accuracy, precision, F1-score, and recall (TPR). The proposed DHGNN classifier achieves the highest accuracy of 0.9980, precision of 0.9898, F1-score of 0.9820, and recall of 0.9322.

Table 4. Performance evaluation of various traffic classification methods

5.2 Application classification (case of 8 classes)

Our focus now was directed towards the second data layer of the CIC-Darknet2020 dataset, which included data samples classified as Media Streaming (Audio and Video), Live Chat, E-mail, P2P, Voice over IP, File Transfer, and Web Browsing. We employ Precision, Recall, F1-score, and Accuracy evaluation metrics to evaluate the performance of the proposed approach.

Figure 6 shows a curve representing the model’s loss as a function of the number of epochs during the training process. The curve starts at a relatively high loss value, indicating that the model’s initial predictions were quite inaccurate or far from the true values at the beginning of the training process. In the early stages of training, the loss curve exhibits a steep decline. This rapid decrease in loss suggests that the model is learning quickly and improving its predictions significantly with each epoch. During this phase, the model is making substantial adjustments to its internal parameters to minimize the error between its predictions and the true values. As the training progresses, the rate at which the loss decreases starts to slow down gradually. This indicates that the model is still improving, but the improvements are becoming smaller. In application classification, the accuracy of our DHGNN model is 98.80%, indicating a very high level of correct predictions.

The circular chart given in Figure 7 shows the distribution of each misclassified class in the case of application classification.

Figure 8 presents the confusion matrix for the 8-class application classification task, illustrating the model's evaluation performance by comparing predicted labels against true labels. The matrix shows generally excellent performance, though with interpretable patterns of misclassification. The most common errors are with Video-Streaming. It is sometimes mistaken for Audio-Streaming (75 samples, 2.42%) and Chat (47 samples, 2.02%). This makes sense because a video stream also contains an audio track, and its data can arrive in bursts, similar to a chat application. Similarly, Audio-Streaming shows minor confusion with VoIP, and Email traffic is moderately confused with Browsing (72 samples, 6.33%), reflecting the real-world ambiguity of HTTPS-based webmail services. A notable case is the VOIP class, which has a higher error rate. It is often misclassified as Browsing, Email, or Audio-Streaming. On the other hand, applications with very unique traffic patterns, like P2P and File-Transfer, are almost never confused with anything else. They are identified perfectly. In summary, most of the model's mistakes happen between application types that naturally have very similar network behavior. This shows a real-world challenge in classifying network traffic, not a major problem with the model itself.

Figure 6. Model’s loss as a function of an epoch during the training process – Application case

Figure 7. Proportion of each misclassified class – Application case

Figure 8. Confusion matrix for multi-class flow classification – Application case

Table 5 presents the recall values of the different models for classifying various applications, such as Audio-streaming, Browsing, Chat, Email, Transfer, P2P, VOIP, and Video-streaming. The proposed DHGNN classifier achieves the highest recall for most applications, including Browsing (0.9800), Chat (0.9587), Transfer (0.9892), P2P (0.9984), VOIP (0.9691), and Video-stream (0.8610). DGNN [26] performs better for Audio-Streaming and Email classification with a recall of 0.9788 and 0.9682, respectively.

For a fair and direct comparison, the proposed DHGNN model is evaluated alongside the DGNN model [26] under identical experimental conditions, including dataset splits, preprocessing steps, and evaluation metrics. The results demonstrate that our model achieves superior performance. The results for other models (e.g., GCN, GAT, GraphSAGE) are provided as a general benchmark from the cited literature and were obtained under different experimental setups.

Table 5. Comparison of application classification methodologies’ recall results

Table 6 compares the performance of different methods, including Random Forest (RF), ensemble methods (RF+KNN+DT), ResGAT, DeepImage, CNN+LSTM, and the proposed DHGNN and DGNN models, on an application classification task. The metrics reported are accuracy, F1-score, and the model used. The proposed DHGNN model achieves the highest F1-score of 0.9879 and an accuracy of 0.9880, outperforming the other methods. DGNN also performs well with an accuracy of 0.9906 and an F1-score of 0.9569.

Table 6. Performance comparison of different application classification models