Network Analysis of Dark Web Traffic Through the Geo-Location of South African IP Address Space

Abstract

The recent public disclosure of mass surveillance of electronic communication, involving powerful government authorities, has drawn the public’s attention to issues regarding Internet privacy. For almost a decade now, there have been several research efforts towards designing and deploying open-source, trustworthy, and reliable systems that ensure users’ anonymity and privacy. These systems operate by hiding the true network identity of communicating parties against eavesdropping adversaries. TOR, acronym for The Onion Router, is an example of such a system. Such systems relay the traffic of their users through an overlay of nodes that are called Onion Routers and are operated by volunteers distributed across the globe. Such systems have served well as anti-censorship and anti-surveillance tools. The implementation of TOR allows an individual to access the Dark Web, an area of the Internet said to be of a much larger magnitude than the Surface Web. The Dark Web has earned a connotation as a sort of immense black market, associated with terrorist groups, child pornography, human trafficking, sale of drugs, and conspiracies, and hacking Dark Web research has received significant national and international press coverage. However, to date, little or no research has been conducted on the illicit usage TOR usage by South Africans. To date, there has yet to be a study that characterizes the usage of a real deployed anonymity service. Observations and analysis obtained are presented by participating in the TOR network. The primary goal is to elicit TOR usage by South Africans. In particular, interest is focused in answering the following question: 1. How is TOR being used?