Behavioral Information Leakage in Darknet Traffic: A Multi-Channel Analysis Across Anonymity Networks

2026-08-04

AI Summary

This study addresses the limited understanding of behavioral mechanisms underlying encrypted services in existing dark web traffic classification research. The authors propose a behavioral information leakage analysis framework that decomposes traffic into three feature categories: control, structure, and rhythm. They introduce a joint structure–rhythm representation, a service variability index, and a leakage variability index to systematically evaluate behavioral leakage differences across Tor, I2P, FreeNet, and ZeroNet. Through normalized mutual information analysis, random forest prediction, structure–rhythm interaction modeling, and leave-one-network-out cross-validation, the study finds that Tor exhibits the highest service separability (Macro-F1 = 0.7165), while FreeNet demonstrates the lowest leakage. Video services show consistent discriminability across networks, whereas chat and email services exhibit markedly divergent performance depending on the underlying anonymity network.

Abstract

Existing darknet traffic classification studies largely emphasize predictive accuracy while offering limited insight into the behavioral mechanisms that make encrypted services distinguishable. This paper proposes a behavioral information leakage framework that decomposes flow-level traffic into control, structural, and rhythmic descriptor groups across Tor, I2P, FreeNet, and ZeroNet. The framework combines normalized mutual information analysis with Random Forest-based predictive validation, structural-rhythmic interaction analysis, and cross-network service-variability evaluation under leakage-safe repeated stratified cross-validation. Results show that behavioral leakage varies considerably across anonymity networks. Tor achieves the highest service separability, with a Macro-F1 of 0.7165 and cumulative normalized leakage of 3.9461, whereas FreeNet exhibits the lowest combined leakage of 0.8744. Packet-size organization, directional exchange imbalance, packet tempo, and silence-burst behavior emerge as the main leakage mechanisms. The combined structural-rhythmic representation consistently provides the strongest within-network performance, while leave-one-network-out evaluation reveals limited transferability across anonymity architectures. The proposed Service Variability Index and Leakage Variability Index further show that video exhibits consistent network-specific separability, whereas chat and email demonstrate greater variability across anonymity-network pairs.

Problem

• behavioral information leakage
• darknet traffic
• anonymity networks
• traffic classification
• service separability

Innovation

• behavioral information leakage
• multi-channel traffic analysis
• anonymity networks
• structural-rhythmic representation
• service variability index