Siddique Abubakr Muntaka

Siddique Abubakr Muntaka, Jacques Bou Abdo

The Invisible Internet Project (I2P) is a peer-to-peer anonymous overlay network whose architecture includes a structurally distinct sublayer not characterized in existing security literature. We term this sublayer the Exclusive Network: nodes here host operational services and draw on I2P's routing resources, but publish no RouterInfo record to the network's distributed database (NetDB). In a controlled three-node testbed, we demonstrate that an Exclusive Network node survives sequential floodfill queries from a pool of routers with zero NetDB hits, while its hosted service remains continuously accessible to authorized peers. This property is exploitable by documented I2P-based malware, for example, I2PRAT (RATatouille), for persistent command-and-control operations against national assets or corporate networks. The structure is analogous to nation-state Operational Relay Box (ORB) infrastructure. The existence of this sublayer, together with the inability of top-down empirical mapping to characterize it, motivates a move toward formal analytical methods to understand the emergence and behavior of covert networks within I2P.

Siddique Abubakr Muntaka, Muntaka Mohammed, Mansuru Mikail Azindo et al.

The Invisible Internet Project (I2P) provides strong anonymity through garlic routing and distributed network architecture, making it attractive for legitimate privacy needs. Nevertheless, the same properties can be exploited by malicious actors to steal sensitive information from corporate networks without detection. Current network security measures often fail to detect I2P traffic, and existing literature has focused primarily on protocol-level traffic identification without addressing behavioral threat assessment. This paper proposes a two-stage machine-learning model for I2P traffic analysis using the SafeSurf Darknet 2025 dataset comprising 184,548 network flows. Phase 1 achieved 99.96% accuracy in distinguishing I2P traffic from normal network traffic using a Random Forest classifier, with only 2 false positives among 32,318 normal flows. Phase 2 performed behavioral analysis on traffic identified as I2P, classifying it as either exfiltration or legitimate activity, achieving 91.11% accuracy using XGBoost. The system demonstrates that tree-based ensemble methods substantially outperform deep neural networks and support vector machines for this task. Feature importance analysis indicates that the most discriminative features are packet timing and flow duration. These findings establish that accurate I2P traffic detection and threat prioritization are achievable in operational network environments, enabling security teams to focus resources on high-risk events rather than monitoring all encrypted traffic.

Siddique Abubakr Muntaka, Edward Danso Ansong, Benjamin Yankson et al.

Uninterrupted system availability is a critical requirement for enterprise operations, yet traditional high-availability clusters suffer from limitations such as single points of failure and inefficient resource allocation. This paper introduces and evaluates the Integrated High Availability Cluster (iHAC), a hybrid architecture designed to enhance system resilience and performance. The iHAC integrates the strengths of active-active and active-passive configurations to optimize workload distribution and failover capabilities. We conducted a comparative analysis, simulating iHAC against conventional (legacy) clusters using Riverbed Modeler (OPNET). The results reveal significant performance improvements: iHAC reduced the average HTTP page response time by over 40%, from five seconds in a traditional active-active setup to under three seconds. This was achieved alongside reduced network latency and increased overall throughput. This study validates the iHAC architecture as a superior design for building robust, high-performance systems, offering a practical path to greater operational continuity and resilience.

Siddique Abubakr Muntaka, Jess Kropczynski, Jacques Bou Abdo et al.

The Invisible Internet Project (I2P) routes data via encrypted, decentralized tunnels. Peer selection can significantly affect security and performance. This empirical study examines whether geographic location systematically influences I2P's routing topology. Consistent with I2P's design principles, which include avoiding multiple peers from the same /16 IP subnet to maximize anonymity, we conducted assortativity analysis, community detection, and permutation testing on data from 327 routers and 254 connections (SWARM-I2P). We found a network-level absence of significant geographic homophily. The assortativity coefficient was r = 0.017 (p = 0.222). Same-country connections (11.1%) are statistically near random expectation (10.91%). Community detection found 110 highly modular groups (Q = 0.972) only moderately aligned geographically (NMI = 0.521). We conclude that aggregate peer selection in I2P leads to a highly heterogeneous, random geographical mixing, providing a foundation for understanding the performance-anonymity tradeoff.