Anonymous networks play a crucial role in preserving information privacy, yet simultaneously spark technical conflicts and gamesmanship between their maintainers and regulatory authorities. To solve the above conflicts and economic losses in real networks, it is imminent to realize adversarial exercises in anonymous networks and validate new technologies and scenarios in the cyber range. It is well known that the two dominant types of anonymity networks are Tor and Invisible Internet Project (I2P). This paper establishes a cyber range based on I2P to realize a task-driven automated scenario construction technique. The proposed task-driven automated scenario construction technique can solve the problem of decoupling between business scenarios and I2P cyber range network infrastructure. Specifically, our approach allows users to upload models/executable code to extend flexibly and fine-grained control I2P nodes, protocols, and traffic behavior characteristics. Then it empowers users to define application scenarios as needed, enabling them to handle intricate business scenarios programmatically. Therefore, it further supports diverse adversarial exercises and the validation of new technologies and scenarios within the dark web.

Many studies have revealed the vulnerability of deep neural networks (DNNs) in the face of adversarial attacks. By adding a small perturbation to the input, adversarial attacks could fool many advanced models for computer vision, speech recognition and natural language processing tasks, posing severe security threats to DNNs. In this paper, we proposed a gradient-based word-level attack method in the embedding space to attack text classification models. This method computes the significance of each word and chooses the optimal word for substitution after word embedding; the generated adversarial texts have little semantic changes but could successfully fool classification DNNs. Through extensive experiments, we confirmed that the generated adversarial texts could achieve a success rate approaching 100% with a very low word substitution rate in attacking the WordCNN and LSTM models on three datasets. By human evaluation, the adversarial texts evaded human notice which implied little semantic changes were made. Experiments on different models also confirmed the transferability of the adversarial texts. Finally, we adopted adversarial training, and this improved the models' generalization capacity and robustness.