TOR (The Onion Router) enables anonymous communication, but it can also be exploited for cybercrime. TOR Unmask is a machine learning-based system that detects and classifies TOR and non-TOR network traffic using network flow analysis.
✅ Detects whether a network flow is from TOR or Non-TOR
✅ 98.8% accuracy using RandomForestClassifier
✅ Real-time classification with a Flask API
✅ Feature selection for optimized prediction speed
✅ React.js frontend for user-friendly testing
- Machine Learning: Scikit-Learn, Pandas, NumPy
- Backend: Flask, Joblib, SMOTE
- Frontend: React.js
- Deployment: Flask API
The model is trained on a dataset with 15 selected network flow features, after removing redundant ones.
📌 Selected Features:
Flow Duration, Flow Bytes/s, Flow Packets/s, Flow IAT Mean, Flow IAT Std,
Flow IAT Max, Flow IAT Min, Fwd IAT Mean, Fwd IAT Std, Fwd IAT Max,
Fwd IAT Min, Bwd IAT Mean, Bwd IAT Std, Bwd IAT Max, Bwd IAT Min
git clone https://github.com/TheCoderAdi/TORUnmask
cd TOR-Unmaskpip install -r src/requirements.txtpython src/train.pyThis will save the trained model as best_model.pkl.
python app.pyFlask API will start at:
🔗 http://127.0.0.1:5000/predict
curl -X POST "http://127.0.0.1:5000/predict" -H "Content-Type: application/json" \
-d '{"features": [0.9, 0.8, 0.7, 0.6, 0.5, 0.4, 0.3, 0.2, 0.1, 0.0, 0.2, 0.4, 0.6, 0.8, 1.0]}'curl -X POST "http://127.0.0.1:5000/predict" -H "Content-Type: application/json" \
-d '{"features": [4940714, 299553.87, 363.51, 2752.49, 12223.80, 108627, -128, 4127.58, 15000.11, 108830, 3, 8105.28, 20493.49, 108808, 28]}'🔥 Train Accuracy: 99.95%
🎯 Test Accuracy: 98.79%
🔥 F1-Score: 96.47%
⚡ Precision: 96.78%
🔥 Recall: 96.18%
This project is open-source under the MIT License.
💬 Developer: Aditya Swayamsiddha
🔗 LinkedIn: https://www.linkedin.com/in/aditya-swayamsiddha-576ab426a/