Time-Dependent Classification of Encrypted Traffic Using LSTM Architecture and Comparative Evaluation with Current Models

Abstract

While the dark web is designed to protect user privacy, it is also susceptible to misuse by malicious actors. Therefore, the effective classification of dark web (Tor and NonTor) traffic is of significant importance in cybersecurity. Findings from the literature reveal that time series-based methods are rarely employed in the detection of Tor network traffic. In this study, the performance of a long short-term memory (LSTM)-based deep learning model—commonly used in time series analysis—is investigated for the classification of Tor and NonTor network traffic alongside traditional machine learning techniques. This approach, which is supported by existing research findings, is further implemented within a graphical user interface (GUI) developed in the MATLAB environment. This interface allows users to upload datasets, apply data filtering, and perform detection using the model of their choice. The proposed system’s accuracy and overall performance demonstrate successful outcomes compared with results reported in the literature. The scientific contribution of this study lies in the development of a time series-based, GUI-supported application that presents a comparative evaluation of LSTM and conventional ML methods. Furthermore, the system provides both theoretical and practical advancements for network traffic analysis by integrating these models into a user-friendly interface.

Keywords

• Cybersecurity
• Dark Web
• Tor Network
• LSTM
• Machine Learning

References

1. Abu Al-Haija, Q., Obaidat, M. J., Al-Syouf, I. A., Awawdeh, Y. F., & Masa'deh, A. E. (2025). SafeSurf Darknet 2025: A novel dataset for darknet traffic detection and analysis. Preprints, 2025071926. https://doi.org/10.20944/preprints202507.1926.v1 google scholar
2. Alashjaee, A. (2025). Deep learning for network security: an Attention-CNN-LSTM model for accurate intrusion detection. Scientific Reports, 15. https://doi.org/10.1038/s41598-025-07706-yhttps://doi.org/10.1038/s41598-025-07706-y google scholar
3. Asadi, M., Heidari, A., & Navimipour, N. (2025). A new flow-based approach for enhancing botnet detection efficiency using convolutional neural networks and long short-term memory. Knowledge and Information Systems, 67, 6139 - 6170. https://doi.org/10.1007/s10115-025-02410-9 google scholar
4. Bakhshi, T., & Ghita, B. (2021). Anomaly detection in encrypted internet traffic using hybrid deep learning. Secur. Commun. Networks, 2021, 5363750:1-5363750:16. https://doi.org/10.1155/2021/5363750 google scholar
5. Demirel, N. B., & Erden, A. (2025). Makine öğrenmesi algoritmaları ile şifreli trafiğin sınıflandırılması. Gazi Journal of Engineering Sciences, 11(1), 48–68. https://doi.org/10.30855/gmbd.070525n04 google scholar
6. Etyang, F., Pavithran, P., Mwendwa, G., Mandela, N., & Hillary, M. (2024). Enhanced Deep Learning Approaches for Robust Darknet Traffic Classification. 2024 3rd Edition of IEEE Delhi Section Flagship Conference (DELCON), 1-7. https://doi.org/10.1109/delcon64804.2024.10866386 google scholar
7. Gudla, R., Vollala, S., Srinivasa, K. G., & Amin, R. A. (2024). Novel approach for classification of Tor and Non-Tor traffic using efficient feature selection methods. Expert Syst. Appl.. https://doi.org/10.1016/j.eswa.2024.123544 (2024). google scholar
8. Gueriani, A., Kheddar, H., & Mazari, A. (2024). Adaptive cyber-attack detection in IIoT using attention-based LSTM-CNN models. Proceedings of the 2024 International Conference on Telecommunications and Intelligent Systems (ICTIS), 1-6. https://doi.org/10.1109/ictis62692.2024.10894509https://doi.org/10.1109/ictis62692.2024.10894509 google scholar

9. Hnamte, V., Nhung-Nguyen, H., Hussain, J., & Hwa-Kim, Y. (2023). A novel two-stage deep learning model for network intrusion detection: LSTM-AE. IEEE Access, 11, 37131-37148. https://doi.org/10.1109/access.2023.3266979 google scholar
10. İlgün, E. G., et al. (2023). Detection and classification of DarkWEB traffic using machine learning. Gazi Mühendislik Bilimleri Dergisi, 9(1), 13-25. https://doi.org/10.30855/gmbd.0705S13 google scholar
11. Jiang, L. (2025). A Network Anomaly Traffic Detection Method Based on CNN‐LSTM. Security and Privacy, 8. https://doi.org/10.1002/spy2.70033 google scholar
12. Johnson, T., Patel, S., & Kumar, R. (2021). Hybrid machine and deep learning approaches for Tor traffic detection. Journal of Internet Services and Information Security, 11(2), 44-59. https://doi.org/10.22667/JISIS.2021.02.28.044 google scholar
13. Kaddes, M., Ayid, Y., Elshewey, A., & Fouad, Y. (2025). Breast cancer classification based on hybrid CNN with LSTM model. Scientific Reports, 15. https://doi.org/10.1038/s41598-025-88459-6 google scholar
14. Kosare, H., & Zade, A. (2025). Improved classification accuracy using a proposed deep learning model: a comparative analysis with VGG, INCEPTION, LSTM, and GRU architectures. Lex localis - Journal of Local Self-Government. https://doi.org/10.52152/800329 google scholar
15. Lan, J., Liu, X., Li, B., Li, Y., & Geng, T. (2022). DarknetSec: A novel self-attentive deep learning method for darknet traffic classification and application identification. Computer Security, 116, 102663. https://doi.org/10.1016/j.cose.2022.102663 google scholar
16. Li, J., & Pan, Z. (2025). Dark web traffic classification based on spatial-temporal feature fusion and attention mechanism. Comput., 14, 248. https://doi.org/10.3390/computers14070248https://doi.org/10.3390/computers14070248 google scholar
17. Li, J., Pan, Z., & Jiang, K. (2025). A three-dimensional convolutional neural network for dark web traffic classification based on multi-channel image deep learning. Comput., 14, 295. https://doi.org/10.3390/computers14080295https://doi.org/10.3390/computers14080295 google scholar
18. Liu, Z., Xie, Y., Luo, Y., Wang, Y., & Ji, X. (2025). TransECA-Net: A Transformer-Based Model for Encrypted Traffic Classification. Applied Sciences, 69, 69–69. https://doi.org/10.3390/app15062977 google scholar
19. Mandela, N., , S., Mistry, N., & Nagpal, A. (2025). Efficient dark web traffic classification using a hybrid CNN-LSTM model. International Journal of Information Technology. https://doi.org/10.1007/s41870-025-02427-xMandela">https://doi.org/10.1007/s41870-025-02427-xMandela, N., , S., Mistry, N., & Nagpal, A. (2025). Efficient dark web traffic classification using a hybrid CNN-LSTM model. International Journal of Information Technology. https://doi.org/10.1007/s41870-025-02427-x google scholar
20. Messaoud, M. (2025). CLASSIFICATION OF NETWORK TRAFFIC USING MACHINE LEARNING MODELS ON THE NETML DATASET. International Journal of Computer Networks & Communications. https://doi.org/10.5121/ijcnc.2025.17307 google scholar
21. P. Choorod and G. Weir, "Tor Traffic Classification Based on Encrypted Payload Characteristics," 2021 National Computing Colleges Conference (NCCC), Taif, Saudi Arabia, 2021, pp. 1-6, doi: 10.1109/NCCC49330.2021.9428874. https://www.researchgate.net/publication/351594507_Tor_Traffic_Classification_Based_on_Encrypted_Payload_Characteristics google scholar
22. Uğurlu, A., et al. (2022). Comparative analysis of machine learning algorithms for darknet traffic classification using CIC-Darknet2020. Computers & Electrical Engineering, 101, 108019. https://doi.org/10.1016/j.compeleceng.2022.108019 google scholar
23. Saini, J. (2023). LSTM based deep learning approach to detect online violent activities over dark web. Multimedia Tools and Applications, 83, 42379-42390. https://doi.org/10.1007/s11042-023-17222-8 google scholar
24. Sangher, K., Singh, A., Pandey, H., & Kumar, V. (2023). toward safe cyber practices: Developing a proactive cyber-threat intelligence system for dark web forum content by identifying cybercrimes. Inf., 14, 349. https://doi.org/10.3390/info14060349 google scholar
25. Silivery, A., & Kovvur, R. (2023). A model for multi-attack classification to improve intrusion detection performance using deep learning approaches. ArXiv, abs/2310.16380. https://doi.org/10.1016/j.measen.2023.100924 google scholar
26. Wang, J., Huang, N., Zhang, H., Liu, L., Fu, Q., Cao, K., Guo, X., & Jung, H. (2025). Self-learning model fusion for network anomaly detection: A hybrid CNN-LSTM-transformer framework. PLOS ONE, 20. doi: 10.1371/journal.pone.0332502 google scholar
27. Xu, S., Geng, G., Jin, X. B., & Xiao, J. (2024). An encrypted traffic classification approach based on path signature features and LSTM. Electronics, 13(15), 3060. https://doi.org/10.3390/electronics13153060 google scholar