I2P Anonymous Traffic Detection and Identification

Nowadays, network users are more and more aware of privacy protection. Anonymous communication technology has attracted much attention because it can hide the identity information of both sides of communication to achieve secure communication. Invisible Internet Project (I2P) is the most widely used open source anonymous communication tool besides The Onion Router (TOR) and Java Anon Proxy (JAP). It detects and identifies I2P traffic in the network, which plays an important role in network security monitoring and protection. Based on the analysis of the implementation mechanism of I2P anonymous service, this paper achieves the discovery and collection of I2P internal resources, and further analyses the NTCP communication protocol of I2P to realize the detection and identification of I2P network traffic. In addition, based on four traffic classification algorithms, the identification and classification of data traffic in I2P network are realized at anonymous service level, and the correlation between the selection of network traffic characteristics and classification performance is analyzed. The results show that Random Forest has the best classification performance compared with the other three classification algorithms. The classification performance improves with the decrease of the number of network traffic features selected.