Detecting Data Exfiltration through I2P Anonymity Networks: A Two-Phase Machine Learning Approach
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866911700100317184 |
|---|---|
| author | Muntaka, Siddique Abubakr Mohammed, Muntaka Azindo, Mansuru Mikail Tanko, Ibrahim Osei-Wusu, Franco Ansong, Edward Danso Yankson, Benjamin Kornyo, Oliver Yeboah, Foster Yeboah, Jones Adams, Richmond Serwaa, Pulcheria |
| author_facet | Muntaka, Siddique Abubakr Mohammed, Muntaka Azindo, Mansuru Mikail Tanko, Ibrahim Osei-Wusu, Franco Ansong, Edward Danso Yankson, Benjamin Kornyo, Oliver Yeboah, Foster Yeboah, Jones Adams, Richmond Serwaa, Pulcheria |
| contents | The Invisible Internet Project (I2P) provides strong anonymity through garlic routing and distributed network architecture, making it attractive for legitimate privacy needs. Nevertheless, the same properties can be exploited by malicious actors to steal sensitive information from corporate networks without detection. Current network security measures often fail to detect I2P traffic, and existing literature has focused primarily on protocol-level traffic identification without addressing behavioral threat assessment. This paper proposes a two-stage machine-learning model for I2P traffic analysis using the SafeSurf Darknet 2025 dataset comprising 184,548 network flows. Phase 1 achieved 99.96% accuracy in distinguishing I2P traffic from normal network traffic using a Random Forest classifier, with only 2 false positives among 32,318 normal flows. Phase 2 performed behavioral analysis on traffic identified as I2P, classifying it as either exfiltration or legitimate activity, achieving 91.11% accuracy using XGBoost. The system demonstrates that tree-based ensemble methods substantially outperform deep neural networks and support vector machines for this task. Feature importance analysis indicates that the most discriminative features are packet timing and flow duration. These findings establish that accurate I2P traffic detection and threat prioritization are achievable in operational network environments, enabling security teams to focus resources on high-risk events rather than monitoring all encrypted traffic. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2605_20546 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Detecting Data Exfiltration through I2P Anonymity Networks: A Two-Phase Machine Learning Approach Muntaka, Siddique Abubakr Mohammed, Muntaka Azindo, Mansuru Mikail Tanko, Ibrahim Osei-Wusu, Franco Ansong, Edward Danso Yankson, Benjamin Kornyo, Oliver Yeboah, Foster Yeboah, Jones Adams, Richmond Serwaa, Pulcheria Cryptography and Security Networking and Internet Architecture The Invisible Internet Project (I2P) provides strong anonymity through garlic routing and distributed network architecture, making it attractive for legitimate privacy needs. Nevertheless, the same properties can be exploited by malicious actors to steal sensitive information from corporate networks without detection. Current network security measures often fail to detect I2P traffic, and existing literature has focused primarily on protocol-level traffic identification without addressing behavioral threat assessment. This paper proposes a two-stage machine-learning model for I2P traffic analysis using the SafeSurf Darknet 2025 dataset comprising 184,548 network flows. Phase 1 achieved 99.96% accuracy in distinguishing I2P traffic from normal network traffic using a Random Forest classifier, with only 2 false positives among 32,318 normal flows. Phase 2 performed behavioral analysis on traffic identified as I2P, classifying it as either exfiltration or legitimate activity, achieving 91.11% accuracy using XGBoost. The system demonstrates that tree-based ensemble methods substantially outperform deep neural networks and support vector machines for this task. Feature importance analysis indicates that the most discriminative features are packet timing and flow duration. These findings establish that accurate I2P traffic detection and threat prioritization are achievable in operational network environments, enabling security teams to focus resources on high-risk events rather than monitoring all encrypted traffic. |
| title | Detecting Data Exfiltration through I2P Anonymity Networks: A Two-Phase Machine Learning Approach |
| topic | Cryptography and Security Networking and Internet Architecture |
| url | https://arxiv.org/abs/2605.20546 |