Towards an Automated Process to Categorise Tor’s Hidden Services

Abstract

It has been argued that the anonymity the dark web offers has allowed criminals to use it to run a range of criminal enterprises, acting with impunity and beyond the reach of law enforcement. By designing a process that can identify sites based on their criminality, law enforcement officers can devote their resources to finding the people behind the sites, rather than having to spend time identifying the sites themselves. The scope of the study in this chapter is focused solely on Tor’s hidden services. The research problem was to identify what percentage of hidden services are accessible and how many of these are connected to criminal/illicit activities. Additionally, our research also aims to determine if it is possible to automate a system to identify sites of interest for law enforcement by categorising them based on the prevalent crime type of the hidden service. In this chapter, we look at how hidden services are set up. To facilitate this, an experiment was conducted where a hidden service was set up and hosted on the Tor network. It is connected to the Tor network and obtained an un-attributable IP address, identified over 12,800.onion addresses from which it scraped the HTML from the home page, before checking this against a pre-determined list of keywords to identify illicit sites and categorise each of these dependant on their type of criminality. Our approach successfully identified criminal sites without the need for human interaction making it a very useful triage solution. Whilst further work is required before its categorisation process is sufficiently robust enough to provide an accurate, unquestionable strategic overview of hidden services, the tool in essence, works very well in achieving its primary function; to identify criminal sites across the dark web.