Leakage-Aware Explainable Two-Stage Framework for Behavioral Darknet and Encrypted-Traffic Classification

Abstract

: Automated darknet traffic detection remains challenging because The Onion Router (TOR) and Virtual Private Network (VPN) technologies can conceal legitimate and malicious traffic. Existing studies based on the CIC-Darknet2020 dataset often report near-perfect results using host or session-related identifiers, raising feature-leakage concerns. This study proposes an interpretable, leakage-aware framework that combines controlled feature ablation with a two-stage classification strategy. Stage 1 detects darknet traffic, while Stage 2 classifies eight darknet applications. Under random splitting, the leakage-controlled model achieves a macro-F1 score of 0.976, Matthews correlation coefficient (MCC) of 0.952, and Receiver Operating Characteristic (ROC)-Area Under the Curve (AUC) of 0.9987. Under host-disjoint evaluation, performance decreases to a macro-F1 of 0.910, indicating reduced generalization when traffic from previously unseen hosts is encountered. Adversarial validation further reveals residual host structure with a balanced accuracy of 0.862, suggesting that some host-specific information remains implicitly encoded in the behavioral features. In the end-to-end cascade, error propagation reduces application-level macro-F1 to 0.827. SHapley Additive exPlanations (SHAP) analysis identifies timing, Transmission Control Protocol (TCP) window, and segment-level statistics as the most influential behavioral features. These findings demonstrate the importance of leakage control, host-aware evaluation, and interpretable transport-level features for reliable darknet traffic classification, while the observed host-disjoint performance drop and residual host signal highlight the presence of dataset and host-specific structure that should be considered when interpreting reported performance.