Skip to main content
SpringerLink
Log in

A first look at references from the dark to the surface web world: a case study in Tor

  • regular contribution
  • Published:
International Journal of Information Security Aims and scope Submit manuscript

Abstract

Tor is the most well-known anonymity network that protects the identity of both content providers and their clients against any tracking on the Internet. The previous research on Tor investigated either the security and privacy concerns or the information and hyperlink structure. However, there is still a lack of knowledge about the information leakage attributed to the links from Tor hidden services to the surface Web. This work addresses this gap by a broad evaluation on: (a) the network of links from Tor to the surface Web, (b) the vulnerability of Tor hidden services against the information leakage, (c) the changes in the overall hyperlink structure of Tor hidden services caused by linking to surface websites, and (d) the type of information and services provided by the domains with significant impact on Tor’s network. The results recover the dark-to-surface network as a single massive, connected component where over 90% of identified Tor hidden services have at least one link to the surface world. We also identify that Tor directories significantly contribute to both communication and information dissemination through the network. Our study is the product of crawling approximately 2 million pages from 23,145 onion seed addresses, over a three-month period.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5

Similar content being viewed by others

Notes

  1. Mozilla/5.0 (X11; Linux \(x86\_64\)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.102 Safari/537.36

  2. All self-loops and multi edges have been removed from this graph.

  3. content is defined as any string outside of a markdown tag.

  4. 3wcwjjnuvjyazeza.onion

  5. It is calculated for networks with no multiple edges.

  6. Pyrowiki is a domain that serves as a pyrotechnics drug wiki.

References

  1. Paul, S., Dingledine, R., Mathewson, N.: The Second-generation Onion Router. In Usenix Security, Tor (2004)

  2. Chertoff, M., Simon, T.: The impact of the dark web on internet governance and cyber security. Global Commission on Internet Governance. No. 6 (2015). https://www.cigionline.org/sites/default/files/ gcig_paper_no6.pdf. Accessed 15 Oct 2015

  3. Henri, V.: The dark web: Some thoughts for an educated debate. Canadian J. Law Technol. 15(1), 85–98 (2017)

  4. Ian, C., Oskar, S., Matthew, T., Verendel, V.: The dark freenet. Network, Private communication through a network of trusted connections (2010)

  5. David, G., Michael, R., Paul, S.: Onion Routing for Anonymous and Private Internet Connections. Technical Report, NAVAL Research Lab Washington DC Center For High Assurance Computing Ssystems (1999)

  6. Sanchez-Rola, I., Balzarotti, D., Santos, I.: The onions have eyes: a comprehensive structure and privacy analysis of tor hidden services. In: Proceedings of the 26th International Conference on World Wide Web, pp. 1251–1260, (2017)

  7. Bernaschi, M., Celestini, A., Guarino, S., Lombardi, F., Mastrostefano, E.: Spiders like onions: on the network of tor hidden services. In: The World Wide Web Conference, pp. 105–115 (2019)

  8. Burda, P., Boot, C., Allodi, L.: Characterizing the redundancy of darkweb. Onion services. In: Proceedings of the 14th International Conference on Availability, Reliability and Security, page 19 (2019)

  9. Griffith, V., Xu, Y., Ratti, C.: Graph theoretic properties of the darkweb. arXiv preprint arXiv:1704.07525 (2017)

  10. Zabihimayvan, M., Sadeghi, R., Doran, D., Allahyari, M.: A broad evaluation of the tor english content ecosystem. In: Proceedings of the 10th ACM Conference on Web Science, pp. 333–342 (2019)

  11. McCoy, D., Bauer, K., Grunwald, D., Kohno, T., Sicker, D.: Shining light in dark places: understanding the tor network. In: Privacy Enhancing Technologies, pp. 63–76 (2008)

  12. Biryukov, A., Pustogarov, I., Weinmann, R.-P.: Trawling for tor hidden services: Detection, measurement, deanonymization. In: Symposium on Security and Privacy, pp. 80–94 (2013)

  13. Biryukov, A., Pustogarov, I.: Bitcoin over tor isn’t a good idea. In: 2015 IEEE Symposium on Security and Privacy, pp. 122–134 (2015)

  14. Cambiaso, E., Vaccari, I., Patti, L., Aiello, M.: Darknet security: a categorization of attacks to the tor network. In: Italian Conference on Cybersecurity, (2019)

  15. Bauer, K., McCoy, D., Grunwald, D., Kohno, T., Sicker, D.: Low-resource routing attacks against tor. In: Proceedings of the 2007 ACM Workshop on Privacy in Electronic Society, pp. 11–20 (2007)

  16. Sanatinia, A., Noubir, G.: Off-path man-in-the-middle attack on tor hidden services. New England Security Day (2017)

  17. Sanatinia, A., Park, J., Blass, E.-O., Mohaisen, A., Noubir, G.: A privacy-preserving longevity study of tor’s hidden services. arXiv preprint arXiv:1909.03576 (2019)

  18. Mohaisen, A., Ren, K.: Leakage of onion at the dns root: measurements, causes, and countermeasures. IEEE/ACM Trans. Netw. 25(5), 3059–3072 (2017)

    Article  Google Scholar 

  19. Cambiaso, E., Vaccari, I., Patti, L., Aiello, M.: Darknet security: a categorization of attacks to the tor network. In: Italian Conference on Cyber Security (2019)

  20. Rajawat, A. S., Rawat, R., Barhanpurkar, K., Shaw, R. N., Ghosh, A.: Vulnerability analysis at industrial internet of things platform on dark web network using computational intelligence. Comput. Intell. Syst. Appl. 39–51 (2021)

  21. Xu, J., Hsinchun, C.: The topology of dark networks. Commun. ACM 51(10), 58–65 (2008)

    Article  Google Scholar 

  22. Massimo, B., Alessandro, C., Stefano, G., Flavio, L.: Exploring and analyzing the tor hidden services graph. ACM Trans. Web 11(4), 24 (2017)

    Google Scholar 

  23. Zabihimayvan, M., Sadeghi, R., Kadariya, D., Doran, D.: Interaction of structure and information on tor. In: International Conference on Complex Networks and Their Applications, pp. 296–307. Springer (2020)

  24. Dolliver, D.S., Ericson, S.P., Love, K.L.: A geographic analysis of drug trafficking patterns on the tor network. Geograph. Rev. 108(1), 45–68 (2018)

    Article  Google Scholar 

  25. Dolliver, D.S., Kuhns, J.B.: The presence of new psychoactive substances in a tor network marketplace environment. J. Psycho. Drugs 48(5), 321–329 (2016)

    Article  Google Scholar 

  26. Harviainen, J.T., Haasio, A., Ruokolainen, T., Hassan, L., Siuda, P., Hamari, J.: Information protection in dark web drug markets research. In: Proceedings of the 54th Hawaii International Conference on System Sciences, p 4673, (2021)

  27. Christin, N.: Traveling the silk road: a measurement analysis of a large anonymous online marketplace. In: Proceedings of the 22nd International Conference on World Wide Web, pp. 213–224 (2013)

  28. Dolliver, D.S.: Evaluating drug trafficking on the tor network: Silk road 2, the sequel. Int. J. Drug Policy 26(11), 1113–1123 (2015)

    Article  Google Scholar 

  29. Chen, H., Chung, W., Qin, J., Reid, E., Sageman, M., Weimann, G.: Uncovering the dark web: a case study of jihad on the web. J. Am. Soc. Inf. Sci. Technol. 59(8), 1347–1359 (2008)

    Article  Google Scholar 

  30. Mörch, C.-M., Côté, L.-P., Corthésy-Blondin, L., Plourde-Léveillé, L., Dargis, L., Mishara, B.L.: The darknet and suicide. J. Affect. Disorders 241, 127–132 (2018)

    Article  Google Scholar 

  31. Woodhams, J., Kloess, J.A., Jose, B., Hamilton-Giachritsis, ,: Characteristics and behaviors of anonymous users of dark web platforms suspected of child sexual offenses. Front. Psychol., 12 (2021)

  32. Biryukov, A., Pustogarov, I., Thill, F., Weinmann, R.-P.: Content and popularity analysis of tor hidden services. In: 2014 IEEE 34th International Conference on Distributed Computing Systems Workshops, pp. 188–193 (2014)

  33. Faizan, M., Khan, R.A.: Exploring and analyzing the dark web: a new alchemy. First Monday (2019)

  34. Andrei, B., Ravi, K., Farzin, M., Prabhakar, R., Sridhar, R., Raymie, S., Andrew, T., Janet, W.: Graph structure in the web. Comput. Netw. 33(1–6), 309–320 (2000)

    Google Scholar 

  35. Blei, D.M., Ng, A.Y., Jordan, M.I.: Latent dirichlet allocation. J. Mach. Learn. Res. 3(Jan), 993–1022 (2003)

    MATH  Google Scholar 

  36. Hulpus, I., Hayes, C., Karnstedt, M., Greene, D.: Unsupervised graph-based topic labelling using dbpedia. In: Proceedings of the Sixth ACM International Conference on Web Search and Data Mining, pp. 465–474 (2013)

  37. Zabihimayvan, M., Doran, D.: Some (non-) universal features of web robot traffic. In: Annual Conference on Information Sciences and Systems, pp. 1–6 (2018)

  38. Newman, M.E.J., Michelle, G.: Finding and evaluating community structure in networks. Phys. Rev. E 69(2), 026113 (2004)

    Article  Google Scholar 

  39. Hage, P., Harary, F.: Eccentricity and centrality in networks. Soc. Netw. 17(1), 57–63 (1995)

    Article  Google Scholar 

  40. Brandes, U.: A faster algorithm for betweenness centrality. J. Math. Sociol. 25(2), 163–177 (2001)

    Article  Google Scholar 

  41. Barabasi, A.-L., Oltvai, Z.N.: Network biology: understanding the cell’s functional organization. Nature Rev. Genet. 5(2), 101 (2004)

  42. Mao, G., Zhang, N.: Analysis of average shortest-path length of scale-free network. J. Appl. Math (2013). https://doi.org/10.1155/2013/865643

  43. Liu, J., Ge, H.: Collaboration mechanisms and community detection of statisticians based on ergms and knn-walktrap. Comput. Stat. Data Anal. 168, 107372 (2021)

Download references

Acknowledgements

The statements made herein are solely the responsibility of the authors. The authors appreciate the anonymous reviewers for their useful feedback regarding this article. Thanks should also go to Dr. Reza Sadeghi with his constructive criticism of the manuscript.

Funding

Not applicable

Author information

Authors and Affiliations

  1. Central Connecticut State University, New Britain, CT, USA

    Mahdieh Zabihimayvan

  2. Wright State University, Dayton, OH, USA

    Derek Doran

Authors
  1. Mahdieh Zabihimayvan
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Derek Doran
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Mahdieh Zabihimayvan.

Ethics declarations

Conflicts of interest/Competing interests

On behalf of all authors, the corresponding author states that there is no conflict of interest.

Ethical approval

This article does not contain any studies with human participants or animals performed by any of the authors.

Ethics approval

The manuscript in part or in full has not been submitted or published anywhere.

Code availability

All the experiments used in this research have been conducted using Cytoscape 3.0.

Additional information

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Zabihimayvan, M., Doran, D. A first look at references from the dark to the surface web world: a case study in Tor. Int. J. Inf. Secur. 21, 739–755 (2022). https://doi.org/10.1007/s10207-022-00580-z

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10207-022-00580-z

Keywords

Search

Navigation