Detecting Data Exfiltration through I2P Anonymity Networks: A Two-Phase Machine Learning Approach

• URL: http://arxiv.org/abs/2605.20546v1
• Date: Tue, 19 May 2026 22:46:22 GMT
• Title: Detecting Data Exfiltration through I2P Anonymity Networks: A Two-Phase Machine Learning Approach
• Abstract summary: The Invisible Internet Project (I2P) provides strong anonymity through garlic routing and distributed network architecture.<n>Current network security measures often fail to detect I2P traffic.<n>This paper proposes a two-stage machine-learning model for I2P traffic analysis using the SafeSurf Darknet 2025 dataset.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The Invisible Internet Project (I2P) provides strong anonymity through garlic routing and distributed network architecture, making it attractive for legitimate privacy needs. Nevertheless, the same properties can be exploited by malicious actors to steal sensitive information from corporate networks without detection. Current network security measures often fail to detect I2P traffic, and existing literature has focused primarily on protocol-level traffic identification without addressing behavioral threat assessment. This paper proposes a two-stage machine-learning model for I2P traffic analysis using the SafeSurf Darknet 2025 dataset comprising 184,548 network flows. Phase 1 achieved 99.96% accuracy in distinguishing I2P traffic from normal network traffic using a Random Forest classifier, with only 2 false positives among 32,318 normal flows. Phase 2 performed behavioral analysis on traffic identified as I2P, classifying it as either exfiltration or legitimate activity, achieving 91.11% accuracy using XGBoost. The system demonstrates that tree-based ensemble methods substantially outperform deep neural networks and support vector machines for this task. Feature importance analysis indicates that the most discriminative features are packet timing and flow duration. These findings establish that accurate I2P traffic detection and threat prioritization are achievable in operational network environments, enabling security teams to focus resources on high-risk events rather than monitoring all encrypted traffic.

Related papers

• Autonomous Cyber Defense: Real-Time Attack Detection and Mitigation in Software-Defined Networks Using Machine Learning [78.29352305480285]
  In recent intrusions, the interval between initial access and the first lateral movement has been observed to be as short as 27 seconds.<n>This paper presents a closed-loop framework that detects and blocks attacks in software-defined networks without operator involvement.
  arXiv  Detail & Related papers  (2026-08-22T18:38:39Z)
• PLAA: Packet-level Adversarial Attacks in Network Traffic Detection [14.770994242897055]
  This paper proposes an adversarial attack specifically designed for Network-based Intrusion Detection System (NIDS)<n>Instead of directly generating flow-level features, our approach incrementally generates packet-level features to construct adversarial traffic.<n>The proposed method achieves an average evasion success rate of 92.78%, while ensuring that the generated adversarial traffic remains semantically consistent with the original malicious traffic.
  arXiv  Detail & Related papers  (2026-06-26T07:58:21Z)
• Convolutional-Neural-Networks for Deanonymisation of I2P Traffic [0.0]
  This study investigates the potential for deanonymizing services within the Invisible Internet Project (I2P) network through passive traffic analysis and machine learning techniques.<n>The primary objective is to identify distinctive patterns in I2P traffic despite the encryption of its payload.
  arXiv  Detail & Related papers  (2026-05-12T06:35:37Z)
• ActiveFlowMark: Assessing Tor Anonymity under Active Bandwidth Watermarking [34.15634406550005]
  Low-latency anonymity networks such as Tor remain vulnerable to infrastructure-level traffic analysis.<n>We introduce NATA, a non-invasive active traffic-correlation analysis algorithm.<n>It injects distinguishable throughput patterns into traffic flows through controlled bandwidth perturbations.
  arXiv  Detail & Related papers  (2026-05-07T08:57:57Z)
• TraceRouter: Robust Safety for Large Foundation Models via Path-Level Intervention [44.64827167753535]
  harmful semantics act as distributed, cross-layer circuits, rendering localized interventions brittle and detrimental to utility.<n>We propose textbfTrace, a path-level framework that traces and disconnects the causal propagation circuits of illicit semantics.<n>Trace significantly outperforms state-of-the-art baselines, achieving a superior trade-off between adversarial robustness and general utility.
  arXiv  Detail & Related papers  (2026-01-29T15:58:12Z)
• Multi-view Correlation-aware Network Traffic Detection on Flow Hypergraph [5.64836465356865]
  We propose a multi-view correlation-aware framework named FlowID for network traffic detection.<n>FlowID captures multi-view traffic features via temporal and interaction awareness, while a hypergraph encoder further explores higher-order relationships between flows.<n>We show that FlowID significantly outperforms existing methods in accuracy, robustness, and generalization across diverse network scenarios.
  arXiv  Detail & Related papers  (2025-01-15T06:17:06Z)
• NetFlowGen: Leveraging Generative Pre-training for Network Traffic Dynamics [72.95483148058378]
  We propose to pre-train a general-purpose machine learning model to capture traffic dynamics with only traffic data from NetFlow records.<n>We address challenges such as unifying network feature representations, learning from large unlabeled traffic data volume, and testing on real downstream tasks in DDoS attack detection.
  arXiv  Detail & Related papers  (2024-12-30T00:47:49Z)
• MIETT: Multi-Instance Encrypted Traffic Transformer for Encrypted Traffic Classification [59.96233305733875]
  Classifying traffic is essential for detecting security threats and optimizing network management.<n>We propose a Multi-Instance Encrypted Traffic Transformer (MIETT) to capture both token-level and packet-level relationships.<n>MIETT achieves results across five datasets, demonstrating its effectiveness in classifying encrypted traffic and understanding complex network behaviors.
  arXiv  Detail & Related papers  (2024-12-19T12:52:53Z)
• AI-Driven Fast and Early Detection of IoT Botnet Threats: A Comprehensive Network Traffic Analysis Approach [3.783757921469148]
  This study proposes a comprehensive methodology for analyzing IoT network traffic. It explores a wide spectrum of network features critical for representing network traffic and characterizing benign IoT traffic patterns. Through extensive experimentation with the IoT-23 dataset, we have demonstrated the feasibility of detecting botnet traffic corresponding to different operations and types of bots.
  arXiv  Detail & Related papers  (2024-07-22T14:54:40Z)
• Towards a Near-real-time Protocol Tunneling Detector based on Machine Learning Techniques [0.0]
  We present a protocol tunneling detector prototype which inspects, in near real time, a company's network traffic using machine learning techniques. The detector monitors unencrypted network flows and extracts features to detect possible occurring attacks and anomalies. Results show 97.1% overall accuracy and an F1-score equals to 95.6%.
  arXiv  Detail & Related papers  (2023-09-22T09:08:43Z)
• Enabling certification of verification-agnostic networks via memory-efficient semidefinite programming [97.40955121478716]
  We propose a first-order dual SDP algorithm that requires memory only linear in the total number of network activations. We significantly improve L-inf verified robust accuracy from 1% to 88% and 6% to 40% respectively. We also demonstrate tight verification of a quadratic stability specification for the decoder of a variational autoencoder.
  arXiv  Detail & Related papers  (2020-10-22T12:32:29Z)
• BiDet: An Efficient Binarized Object Detector [96.19708396510894]
  We propose a binarized neural network learning method called BiDet for efficient object detection. Our BiDet fully utilizes the representational capacity of the binary neural networks for object detection by redundancy removal. Our method outperforms the state-of-the-art binary neural networks by a sizable margin.
  arXiv  Detail & Related papers  (2020-03-09T08:16:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.