E2E-MDC: End-to-End Multi-Modal Darknet Traffic Classification with Conditional Hierarchical Mechanism

Accurate identification and classification of Darknet traffic is a critical technical challenge for network security supervision. Existing methods predominantly adopt single-modal features and independent classification strategies, making it difficult to effectively handle the hierarchical structural characteristics and complex encryption patterns of Darknet traffic. This paper proposes E2E-MDC (End-to-End Multi-modal Darknet Classification), an end-to-end deep learning framework based on conditional hierarchical mechanism for three-level hierarchical classification of Darknet traffic. The framework integrates four complementary feature extractors—byte-level CNN, packet sequence TCN, bidirectional LSTM, and Transformer—to comprehensively capture traffic patterns from multiple perspectives. A soft conditional hierarchical classification architecture explicitly models dependencies among Level 1 (Darknet type), Level 2 (application category), and Level 3 (specific behavior) by using upper-level prediction probability distributions as conditional input for lower-level classification. On the self-collected Tor dataset containing 8 applications and 8 behavior types, the system achieves 94.90% cascade accuracy, with Level 3 fine-grained classification accuracy reaching 95.02%. On the public Darknet-2020 dataset, cascade accuracy reaches 92.65%, representing improvements of 12% and 15% over existing state-of-the-art methods, respectively, while reducing hierarchical violation rate to below 0.8%. Experimental results demonstrate that the conditional hierarchical mechanism and multi-modal fusion strategy significantly enhance the accuracy and robustness of Darknet traffic classification, providing effective technical support for network security protection.