research-article

Characterizing the Redundancy of DarkWeb .onion Services

Authors:

Luca AllodiAuthors Info & Claims

ARES '19: Proceedings of the 14th International Conference on Availability, Reliability and Security

Article No.: 19, Pages 1 - 10

https://doi.org/10.1145/3339252.3339273

Published: 26 August 2019 Publication History

Abstract

The Darkweb hosts a number of legal and illegal services that are hard to reach due to the lack, by design, of a regular 'name service' as those operated by DNSs on the clearnet. This difficulty, together with the continuous appearance of decoy mirror services and replicated domains, severely limits the investigation capabilities of researchers and law enforcement agencies interested in measuring the Darkweb phenomenon as a whole. To address this issue we developed MASSDEAL, a tool for the automated exploration of the Darkweb that automatically learns about new or previous unseen services and measures repeatedly across time and space (i.e. across multiple deployments of the same service). Relying on data collected over more than 20 thousand darkweb services sampled from September 2018 to January 2019, we perform and report an extensive analysis of service redundancy and measure the appearance of .onion mirrors as well as providing an estimation of the infrastructural redundancy behind those systems.

References

[1]

Luca Allodi. 2017. Economic factors of vulnerability trade and exploitation. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. ACM, 1483--1499.

Digital Library

[2]

Luca Allodi, Marco Corradin, and Fabio Massacci. 2015. Then and Now: On the Maturity of the Cybercrime Markets. IEEE Transactions on Emerging Topics in Computing (2015).

Digital Library

[3]

Roger Dingledine, Nick Mathewson, and Paul Syverson. 2004. Tor: The second-generation onion router. Technical Report. Naval Research Lab Washington DC.

[4]

Shalini Ghosh, Ariyam Das, Phil Porras, Vinod Yegneswaran, and Ashish Gehani. 2017. Automated Categorization of Onion Sites for Analyzing the Darkweb Ecosystem. In Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD '17). ACM, New York, NY, USA, 1793--1802.

Digital Library

[5]

Shalini Ghosh, Ariyam Das, Phil Porras, Vinod Yegneswaran, and Ashish Gehani. 2017. Automated Categorization of Onion Sites for Analyzing the Darkweb Ecosystem. In Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD '17). ACM, New York, NY, USA, 1793--1802.

Digital Library

[6]

Cormac Herley and Dinei Florencio. 2009. Nobody Sells Gold for the Price of Silver: Dishonesty, Uncertainty and the Underground Economy. Technical Report. https://www.microsoft.com/en-us/research/publication/nobody-sells-gold-for-the-price-of-silver-dishonesty-uncertainty-and-the\-underground-economy/

[7]

Chen Hsinchun, Chung Wingyan, Qin Jialun, Reid Edna, Sageman Marc, and Weimann Gabriel. {n. d.}. Uncovering the dark Web: A case study of Jihad on the Web. Journal of the American Society for Information Science and Technology 59, 8 ({n. d.}), 1347--1359. arXiv:https://onlinelibrary.wiley.com/doi/pdf/10.1002/asi.20838

Digital Library

[8]

Sarah Jamie Lewis. {n. d.}. OnionScan. https://onionscan.org/

[9]

Researching Social Life. 1994. Qualitative data analysis. (1994).

[10]

Rebekah Overdorf, Mark Juárez, Gunes Acar, Rachel Greenstadt, and Claudia Díaz. 2017. How Unique is Your .onion? An Analysis of the Fingerprintability of Tor Onion Services. CoRR abs/1708.08475 (2017). arXiv:1708.08475 http://arxiv.org/abs/1708.08475

Digital Library

[11]

Rebekah Overdorf, Mark Juarez, Gunes Acar, Rachel Greenstadt, and Claudia Diaz. 2017. How unique is your. onion?: An analysis of the fingerprintability of tor onion services. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. ACM, 2021--2036.

Digital Library

[12]

Gareth Owenson, Sarah Cortes, and Andrew Lewman. 2018. The darknet's smaller than we thought: The life cycle of Tor Hidden Services. Digital Investigation 27 (2018), 17--22.

[13]

Andriy Panchenko, Asya Mitseva, Martin Henze, Fabian Lanze, Klaus Wehrle, and Thomas Engel. 2017. Analysis of fingerprinting techniques for tor hidden services. In Proceedings of the 2017 on Workshop on Privacy in the Electronic Society. ACM, 165--175.

Digital Library

[14]

Andrew J Park, Brian Beck, Darrick Fletche, Patrick Lam, and Herbert H Tsang. 2016. Temporal analysis of radical dark web forum users. In Advances in Social Networks Analysis and Mining (ASONAM), 2016 IEEE/ACM International Conference on. IEEE, 880--883.

Digital Library

[15]

Sergio Pastrana, Daniel R Thomas, Alice Hutchings, and Richard Clayton. 2018. Crimebb: Enabling cybercrime research on underground forums at scale. In Proceedings of the 2018 World Wide Web Conference on World Wide Web. International World Wide Web Conferences Steering Committee, 1845--1854.

Digital Library

[16]

Mike Perry. 2013. A Critique of Website Traffic Fingerprinting Attacks. https://blog.torproject.org/critique-website-traffic-fingerprinting-attacks

[17]

Leonard Richardson. {n. d.}. Beautiful Soup. https://www.crummy.com/software/BeautifulSoup/

[18]

Thabit Sabbah, Ali Selamat, Md. Hafiz Selamat, Roliana Ibrahim, and Hamido Fujita. 2016. Hybridized term-weighting method for Dark Web classification. Neurocomputing 173 (2016), 1908--1926.

Digital Library

[19]

Kyle Soska and Nicolas Christin. 2015. Measuring the Longitudinal Evolution of the Online Anonymous Marketplace Ecosystem. In USENIX Security Symposium. 33--48.

Digital Library

[20]

Fu Tianjun, Abbasi Ahmed, and Chen Hsinchun. {n. d.}. A focused crawler for Dark Web forums. Journal of the American Society for Information Science and Technology 61, 6 ({n. d.}), 1213--1231. arXiv:https://onlinelibrary.wiley.com/doi/pdf/10.1002/asi.21323

Digital Library

[21]

Rolf van Wegberg, Samaneh Tajalizadehkhoob, Kyle Soska, Ugur Akyazi, Carlos Hernandez Ganan, Bram Klievink, Nicolas Christin, and Michel van Eeten. 2018. Plug and Prey? Measuring the Commoditization of Cybercrime via Online Anonymous Markets. In 27th USENIX Security Symposium (USENIX Security 18). USENIX Association, Baltimore, MD, 1009--1026. https://www.usenix.org/conference/usenixsecurity18/presentation/van-wegberg

Digital Library

[22]

Hao Yang, Xiulin Ma, Kun Du, Zhou Li, Haixin Duan, Xiaodong Su, Guang Liu, Zhifeng Geng, and Jianping Wu. 2017. How to learn klingon without a dictionary: Detection and measurement of black keywords used by the underground economy. In 2017 IEEE Symposium on Security and Privacy (SP). IEEE, 751--769.

Cited By

Buitrago López APastor-Galindo JGómez Mármol F(2024)Updated exploration of the Tor network: advertising, availability and protocols of onion servicesWireless Networks10.1007/s11276-024-03679-4Online publication date: 25-Feb-2024
https://doi.org/10.1007/s11276-024-03679-4
Zabihimayvan MSadeghi RDoran D(2024)Security, information, and structure characterization of Tor: a surveyTelecommunication Systems10.1007/s11235-024-01149-y87:1(239-255)Online publication date: 20-May-2024
https://doi.org/10.1007/s11235-024-01149-y
López AGalindo JMármol F(2023)Exploring the availability, protocols and advertising of Tor v3 domains2023 JNIC Cybersecurity Conference (JNIC)10.23919/JNIC58574.2023.10205938(1-8)Online publication date: 21-Jun-2023
https://doi.org/10.23919/JNIC58574.2023.10205938
Show More Cited By

Recommendations

Automated Categorization of Onion Sites for Analyzing the Darkweb Ecosystem
KDD '17: Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining

Onion sites on the darkweb operate using the Tor Hidden Service (HS) protocol to shield their locations on the Internet, which (among other features) enables these sites to host malicious and illegal content while being resistant to legal action and ...
Improving the Privacy of Tor Onion Services
Applied Cryptography and Network Security
Abstract
Onion services enable bidirectional anonymity for parties that communicate over the Tor network, thus providing improved privacy properties compared to standard TLS connections. Since these services are designed to support server-side anonymity, ...
Using Inherent Service Redundancy and Diversity to Ensure Web Services Dependability
Methods, Models and Tools for Fault Tolerance

Achieving high dependability of Service-Oriented Architecture (SOA) is crucial for a number of emerging and existing critical domains, such as telecommunication, Grid, e-science, e-business, etc. One of the possible ways to improve this dependability is ...

Comments

Information & Contributors

Information

Published In

cover image ACM Other conferences

ARES '19: Proceedings of the 14th International Conference on Availability, Reliability and Security

August 2019

979 pages

ISBN:9781450371643

DOI:10.1145/3339252

Copyright © 2019 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 26 August 2019

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Qualifiers

Research-article
Research
Refereed limited

Conference

ARES '19

ARES '19: 14th International Conference on Availability, Reliability and Security

August 26 - 29, 2019

CA, Canterbury, United Kingdom

Acceptance Rates

Overall Acceptance Rate 228 of 451 submissions, 51%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

11
Total Citations
View Citations
233
Total Downloads

Downloads (Last 12 months)25
Downloads (Last 6 weeks)6

Reflects downloads up to 22 Sep 2024

Other Metrics

View Author Metrics

Citations

Cited By

Buitrago López APastor-Galindo JGómez Mármol F(2024)Updated exploration of the Tor network: advertising, availability and protocols of onion servicesWireless Networks10.1007/s11276-024-03679-4Online publication date: 25-Feb-2024
https://doi.org/10.1007/s11276-024-03679-4
Zabihimayvan MSadeghi RDoran D(2024)Security, information, and structure characterization of Tor: a surveyTelecommunication Systems10.1007/s11235-024-01149-y87:1(239-255)Online publication date: 20-May-2024
https://doi.org/10.1007/s11235-024-01149-y
López AGalindo JMármol F(2023)Exploring the availability, protocols and advertising of Tor v3 domains2023 JNIC Cybersecurity Conference (JNIC)10.23919/JNIC58574.2023.10205938(1-8)Online publication date: 21-Jun-2023
https://doi.org/10.23919/JNIC58574.2023.10205938
Madimi RSubramanian N(2023)A Forensic Analysis Procedure for Dark Web Drug Marketplaces2023 14th International Conference on Computing Communication and Networking Technologies (ICCCNT)10.1109/ICCCNT56998.2023.10307116(1-6)Online publication date: 6-Jul-2023
https://doi.org/10.1109/ICCCNT56998.2023.10307116
Pastor-Galindo JGómez Mármol FMartínez Pérez G(2023)On the gathering of Tor onion addressesFuture Generation Computer Systems10.1016/j.future.2023.02.024145:C(12-26)Online publication date: 1-Aug-2023
https://dl.acm.org/doi/10.1016/j.future.2023.02.024
Ruiz Ródenas JPastor-Galindo JGómez Mármol F(2023)A general and modular framework for dark web analysisCluster Computing10.1007/s10586-023-04189-227:4(4687-4703)Online publication date: 6-Dec-2023
https://dl.acm.org/doi/10.1007/s10586-023-04189-2
Tazi FShrestha SDe La Cruz JDas S(2022)SoK: An Evaluation of the Secure End User Experience on the Dark Net through Systematic Literature ReviewJournal of Cybersecurity and Privacy10.3390/jcp20200182:2(329-357)Online publication date: 27-May-2022
https://doi.org/10.3390/jcp2020018
Moraliyage HSumanasena VDe Silva DNawaratne RSun LAlahakoon D(2022)Multimodal Classification of Onion Services for Proactive Cyber Threat Intelligence Using Explainable Deep LearningIEEE Access10.1109/ACCESS.2022.317696510(56044-56056)Online publication date: 2022
https://doi.org/10.1109/ACCESS.2022.3176965
Zabihimayvan MDoran D(2022)A first look at references from the dark to the surface web world: a case study in TorInternational Journal of Information Security10.1007/s10207-022-00580-z21:4(739-755)Online publication date: 19-Feb-2022
https://doi.org/10.1007/s10207-022-00580-z
Vojíř SKučera J(2021)Towards Re-Decentralized Future of the Web: Privacy, Security and Technology DevelopmentActa Informatica Pragensia10.18267/j.aip.16910:3(349-369)Online publication date: 31-Dec-2021
https://doi.org/10.18267/j.aip.169
Show More Cited By

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents