Comparative Evaluation of Machine Learning and Deep Learning Models for Flow-Level Multi-Class Darknet Traffic Classification

Encrypted traffic classification is a key problem in network security because encryption and anonymity technologies limit access to packet contents used for monitoring and intrusion detection. This study compares six machine-learning and deep-learning models for classifying Layer 2 darknet traffic, distinguishing among Freenet, I2P, Tor, VPN, and ZeroNet traffic using the SafeSurf dataset. After removing duplicate records and observations with missing or infinite values, the final dataset comprised 75,201 flows described by 79 flow-level features, including port and protocol fields. Random Forest, XGBoost, Multilayer Perceptron (MLP), Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and CNN-LSTM models were evaluated using identical stratified training, validation, and test partitions. Source and destination IP addresses and timestamps were excluded to avoid potential collection-specific information leakage. XGBoost achieved the highest test accuracy (94.78%), macro-F1 (0.9440), and Matthews correlation coefficient (MCC; 0.9308), followed by Random Forest (93.50% accuracy, 0.9299 macro-F1, and 0.9136 MCC). MLP achieved 87.74% accuracy, followed by CNN-LSTM (84.84%), CNN (79.16%), and LSTM (77.13%). I2P and Tor were frequently confused, whereas tree-based models classified minority-class VPN traffic effectively. Removing the port fields lowered tree-model accuracy by 1.3 to 1.61 points without changing their ranking. McNemar’s tests on paired test-set predictions showed significant differences (all p < 0.001) for XGBoost versus Random Forest, XGBoost versus MLP, XGBoost versus CNN-LSTM, and MLP versus CNN-LSTM. These findings demonstrate the potential of flow-level features for five-class darknet technology classification, identify persistent classification challenges, and provide a baseline for evaluating generalisation to independent network environments.