ToRank: Identifying the most influential suspicious domains in the Tor network

Abstract

The Tor network hosts a significant amount of hidden services related to suspicious activities. Law Enforcement Agencies need to monitor and to investigate crimes hidden behind the anonymity provided by Tor. In this paper, we propose a new algorithm, named ToRank, that ranks hidden services in Tor better than the known algorithms used for the Surface Web. We also thoroughly analyze the content present in Tor, creating a dataset, DUTA-10K, that extends the previous Darknet Usage Text Address (DUTA) dataset. We quantitatively compared ToRank with some of the most popular ranking algorithms, like PageRank, HITS, and Katz. Results showed that our proposal obtains a higher harm to the Tor network robustness than all of them, what indicates its superiority for this problem. The analysis of DUTA-10K reveals that only 20% of the hidden services that can be accessed are related to suspicious activities, and 48% are associated with normal ones. We also discovered that domains related to suspicious activities usually present multiple clones under different addresses, what could be used as an additional feature for identifying them. We consider that our new algorithm, the extended dataset, and the findings obtained from the analysis carried out are helpful for LEAs to fight against crimes that take place in the Tor hidden services.