isAnon: Flow-Based Anonymity Network Traffic Identification Using Extreme Gradient Boosting

The abuse of anonymous communication technology brings serious challenges to network supervision. The valid identification of anonymity network traffic is a prerequisite and fundamentally important for preventing the violence of such techniques. However, due to the distinct characteristics of flow from anonymity networks including Tor, I2P, and JonDonym, existing studies don't take full advantage of these features, damaging the accuracy of identification. In this paper, we propose an effective anonymity network traffic identification model, called isAnon. Firstly, isAnon designs a novel hybrid feature selection algorithm by combining Modified Mutual Information and Random Forest (MMIRF) algorithm to filter out some irrelevant and redundant features quickly. Secondly, our proposed model applies a nested cross-validation scheme with an inner 5-fold cross-validation and an outer Monte Carlo cross-validation to prevent model overfitting. Finally, we use the Extreme Gradient Boosting (XGBoost) algorithm to identify Tor, I2P, and JonDonym networks for four scenarios. Comprehensive experimental results on several real-world anonymity network traffic datasets clearly show the effectiveness of our isAnon model compared with state-of-the-art baseline identification methods.