Beyond Classification Accuracy: Quantifying Fingerprint Complexity in Encrypted Darknet Services

Abstract

Existing darknet traffic studies primarily evaluate service fingerprintability through classification performance, providing limited insight into why certain services are easier or harder to identify. This paper introduces the Fingerprint Complexity Score (FCS), a framework for quantifying the intrinsic complexity of darknet service fingerprints using behavioral overlap, uncertainty, disagreement, and persistent confusion. Experiments on 25 services across the Tor, I2P, FreeNet, and ZeroNet anonymity networks reveal substantial variation in fingerprint complexity, with behavioral overlap emerging as the dominant contributor. Validation using Random Forest, Extra Trees, and XGBoost demonstrates a strong inverse relationship between fingerprint complexity and recognition performance (Pearson r = -0.706, Spearman \r{ho} = -0.765, p < 0.001). The findings show that service fingerprintability is fundamentally governed by behavioral complexity, providing a new perspective for analyzing behavioral information leakage in anonymity networks.