Onion Routing Research Articles

Provable Security for the Onion Routing and Mix Network Packet Format Sphinx

Onion routing and mix networks are fundamental concepts to provide users with anonymous access to the Internet. Various corresponding solutions rely on the Sphinx packet format. However, flaws in Sphinx's underlying proof strategy were found recently. It is thus currently unclear which guarantees Sphinx actually provides, and, even worse, there is no suitable proof strategy available. In this paper, we restore the security foundation for all these works by building an analytical framework for Sphinx. We discover that the previously-used Decisional Diffie-Hellman (DDH) assumption is insufficient for a security proof and show that the Gap Diffie-Hellman (GDH) assumption is required instead. We apply it to prove that a slightly adapted version of the Sphinx packet format is secure under the GDH assumption. We are thus, to the best of our knowledge, the first to provide a detailed, in-depth security proof for Sphinx that holds. Our adaptations to Sphinx are necessary, as we demonstrate with an attack on sender privacy that would otherwise be possible in Sphinx's adversary model.

Cybersecurity in Onion Routing Environments: Strategies to Thwart Cyber Threats

Onion routing networks, or darknets, enable anonymous communication, protecting user privacy and attracting cybercriminals. This paper analyzes cybercrime in these networks, including drug trafficking, fraud, and hacking. The challenges seen in the detection and mitigation of these crimes arising as the result of strong anonymity and explore countermeasures such as law enforcement, technological solutions, and policy interventions have been discussed, as also highlighting of the limitations of current measures and proposals for future research, with emphasis on the need for interdisciplinary approaches combining technical, legal, and social perspectives.

Beyond the Onion Routing: Unmasking Illicit Activities on the Dark Web

This comprehensive study delves into the complexities of the Dark Web, a concealed segment of the internet that remains invisible to standard search engines and is accessible only through specialized tools like The Onion Router (TOR), which ensures user anonymity. While the Dark Web is celebrated for its capacity to safeguard privacy and foster free expression, it concurrently serves as a sanctuary for illegal endeavours, encompassing drug trafficking, unauthorized arms trading, and a spectrum of cybercrime. The primary objective of this research is to scrutinize the efficacy of onion routing, the foundational technology behind the Dark Web, in preserving user anonymity amidst escalating efforts by law enforcement agencies to dismantle illegal activities. This paper adopts a rigorous approach that melds an exhaustive review of pertinent literature with empirical investigations to pinpoint the intrinsic vulnerabilities within the onion routing framework. Furthermore, the study introduces innovative methodologies aimed at bolstering the detection and neutralization of illicit transactions and communications on the Dark Web. These proposed methods seek to establish a delicate balance between upholding the Dark Web's legitimate functions—such as protecting privacy and enabling free speech—and curtailing its misuse for criminal activities. The paper culminates in a discussion of the broader implications of these findings for policymakers, law enforcement officials, and privacy advocates. It provides a set of recommendations for future research and policy formulation in this intricate and ever-evolving domain, to navigate the challenges posed by the Dark Web while preserving its essential values.

Cybercrimes in the Darknet and Their Detections: A Comprehensive Analysis and Future Directions

Although the Dark web was originally used for maintaining privacy-sensitive communication for business or intelligence services for defence, government and business organizations, fighting against censorship and blocked content, later, the advantage of technologies behind the Dark web were abused by criminals to conduct crimes which involve drug dealing to the contract of assassinations in a widespread manner. Since the communication remains secure and untraceable, criminals can easily use dark web service via The Onion Router (TOR), can hide their illegal motives and can conceal their criminal activities. This makes it very difficult to monitor and detect cybercrimes over the dark web. With the evolution of machine learning, natural language processing techniques, computational big data applications and hardware, there is a growing interest in exploiting dark web data to monitor and detect criminal activities. Due to the anonymity provided by the Dark Web, the rapid disappearance and the change of the uniform resource locators (URLs) of the resources, it is not as easy to crawl the Drak web and get the data as the usual surface web which limits the researchers and law enforcement agencies to analyse the data. Therefore, there is an urgent need to study the technology behind the Dark web, its widespread abuse, its impact on society and the existing systems, to identify the sources of drug deal or terrorism activities. In this research, we analysed the predominant darker sides of the world wide web (WWW), their volumes, their contents and their ratios. We have performed the analysis of the larger malicious or hidden activities that occupy the major portions of the Dark net; tools and techniques used to identify cybercrimes which happen inside the dark web. We applied a systematic literature review (SLR) approach on the resources where the actual dark net data have been used for research purposes in several areas. From this SLR, we identified the approaches (tools and algorithms) which have been applied to analyse the Dark net data, the key gaps as well as the key contributions of the existing works in the literature. In our study, we find the main challenges to crawl the dark web and collect forum data are: scalability of crawler, content selection trade off, and social obligation for TOR crawler and the limitations of techniques used in automatic sentiment analysis to understand criminals’ forums and thereby monitor the forums. From the comprehensive analysis of existing tools, our study summarizes the most tools. However the forum topics rapidly change as their sources changes; criminals inject noises to obfuscate the forum’s main topic and thus remain undetectable. Therefore supervised techniques fail to address the above challenges. Semi-supervised techniques would be an interesting research direction.

On Being an Expert: Habitus as a Lens for Understanding Privacy Expertise

How do privacy experts and lay persons differ? We investigate this question using data about the use of privacy-enhancing technologies and strategies from 128 surveys and 17 follow-up interviews with two populations: privacy experts (i.e., privacy researchers and professionals) and privacy laypersons. Findings reveal that both experts and laypersons use common privacy strategies, but experts employ a broader range of strategies, favor open source technologies, and possess a more technical understanding of internet privacy risks and technologies such as onion routing and tracking algorithms. We characterize these differences in terms of sociological habitus, where experts and laypersons differ not only in technical skill but also in broader conceptualizations and practices. From this characterization, we make recommendations for technology design practices, as well as legal and pedagogical implications, that can help decenter the experiences of privacy experts and accommodate privacy laypersons' preferences and habits.

A Framework for Provably Secure Onion Routing against a Global Adversary

Onion routing and mix networks are a central technology to enable anonymous communication on the Internet. As such, a large number of protocols and model variants have been explored in the field, which offer differing levels of privacy, exhibit vulnerabilities, or even supersede each other. These factors make discovering the appropriate formalization for new developments difficult, and some model variants have not been formalized at all. We address this issue by creating one parametrized framework that encompasses the onion routing and mix network models and functionalities with a global adversary in the related work. In doing so, we create a categorization of the variants of onion routing models in use in the related work and map common OR and mix network protocols to their variants. For each identified variant: Our framework offers i) an ideal functionality in the Universal Composability framework, and ii) game-based properties that imply realization of the ideal functionality when a protocol satisfies them. In effect, our framework both unifies and extends previous formalization efforts in the field.

A novel approach for classification of Tor and non-Tor traffic using efficient feature selection methods

In the dynamic realm of encrypted communications, traffic analysis and its classification are crucial for efficient resource utilization and network management. The prevalence of encryption technologies, The Onion Router (Tor) a globally recognized privacy-preserving network, poses a challenge for the task at hand by introducing complexity through its innovative onion routing mechanism. To overcome Tor’s limitations not only in terms of achieving better accuracy but also in performing classification in time-constrained scenarios, we propose a classification approach for Tor and non-Tor traffic classification, utilizing multiple models to enhance categorization and application identification. Leveraging the University of New Brunswick (UNB) Tor and non-Tor dataset, initially in a packet capture format, the preprocessing is done by transforming through CICFlowmeter. To expedite classification, we applied feature selection techniques like Principal Component Analysis (PCA) and t-Distributed Stochastic Neighbor Embedding (tSNE). Machine learning algorithms like support vector machine (SVM), Gradient Boosting, Random Forest, and Artificial Neural Network (ANN) are applied. Our approach achieves a remarkable recall score ratio of 1.00, demonstrating high accuracy in Tor traffic identification. Notably, efficient feature selection has significantly reduced classification time. This work also contributes to effective Tor and non-Tor network traffic analysis, offering an efficient model for enhanced security and management.

ДОСЛІДЖЕННЯ МОДЕЛЕЙ АНОНІМНОЇ МАРШРУТИЗАЦІЇ

Numerous solutions have been created for online anonymous communication. We do evaluations of security on several systems. We examine features such as Onion Routing, anonymous VPN services, probabilistic anonymity, and deterministic anonymity among different systems. There are also additional forms of anonymous communication that are discussed, including messaging, peer-to-peer communication, using the web, emailing, and using other Internet apps. We then go on to show several attack methods that aim to identify people who communicate anonymously. The objective of the research is to achieve an exact adjust between guaranteeing the adequacy and dependability of message delivery and ensuring customer anonymity. The NIAR model's non-interactive highlight makes it more valuable since it licenses secure communication without requiring nonstop client support. Communication privacy is threatened by an ever-growing volume of data generated by an ever-growing number of networked devices. Because of this, Anonymous Communication Systems (ACSs)—which offer the privacy qualities of anonymity, unsinkability, and observability—are recommended to conceal the relationship between transmitted communications and their senders and recipients. The objective of this essay is to evaluate the literature on Dining Cryptographers Networks (DCNs) in the subject of ACSs. Since the DCN-based techniques offer unconditional guarantees of observability, they are information-theoretically safe. Their computation and communication expense was considered high at the time, and scalability issues arose, which originally impeded their use for anonymous communications. By satisfying these targets, the research improves the state of encrypted communication systems and opens the door to a day when protecting client security will be a best need without sacrificing message delivery's significant dependability and efficiency.

Multi‐hop anonymous payment channel network based on onion routing

AbstractPayment channel networks (PCNs) are one of the most promising off‐chain solutions to the blockchain scalability problem. However, most current payment channel schemes suffer from overly ideal routing assumptions or fail to provide complete path privacy protection. To address the above problems, the multi‐hop anonymous and privacy‐preserving PCN scheme are analyzed and a multi‐hop anonymous PCN based on onion routing is proposed based on it. The scheme removes the routing assumptions of the original scheme, designs an onion routing‐based payment channel network, and modifies the way relay nodes construct elliptic curve discrete logarithmic problems to resist wormhole attacks. Finally, the security analysis shows that the scheme in this paper has atomicity, relational anonymity and resistance to wormhole attacks. The latest bilinear pairing anonymous multi‐hop payment (EAMHL+) scheme is used to compare communication and computing overhead. The results show that the scheme in this paper requires less communication overhead and is more efficient in terms of computational overhead when the average hop number of the payment channel network is 3 hops and the network diameter is 6 hops.

Timed-release encryption anonymous interaction protocol based on smart contract

Timed-release encryption (TRE) is a cryptographic primitive that can control the decryption time and has significant application value in time-sensitive scenarios. To solve the reliability issue of nodes in existing TRE anonymous interaction schemes, we propose a blockchain-based TRE protocol for anonymous query time trapdoors. In our protocol, the recipient divides the encrypted trapdoor request information into n ciphertext fragments using secret sharing technology near the decryption time, and employs the idea of onion routing to perform layer-by-layer encryption, creating onion-type data transmitted through middlemen selected from the smart contract. After receiving the ciphertext fragments, the time server integrates them to obtain the trapdoor request information and returns the corresponding time trapdoor to the recipient. This allows the recipient to query any time trapdoor anonymously. Our protocol provides a normative design for the smart contract and specific constraints on the participants’ behavior. Compared with the related anonymous query trapdoor schemes, our protocol improves the probability of successful queries. Security analysis shows that our protocol can resist release-ahead attack, interruption attack, eavesdropping attack, and replacement attack. Performance analysis shows that our protocol outperforms related protocols regarding anonymity, efficiency, and flexibility, achieving highly efficient anonymous interactions. Finally, we conducted an experiment in the Ethereum Rinkeby test network. For the settings of ciphertext fragment number n=3 and ciphertext fragment threshold t=2, the gas consumption for a user to execute the contract was $5.66, which was higher than the contract cost of related schemes, but the contract execution cost was within an acceptable range.

Cybersecurity in Onion Routing Environments: Strategies to Thwart Cyber Threats

Cybersecurity in Onion Routing Environments: Strategies to Thwart Cyber Threats

Blockchain-Envisioned Onion Routing Framework for Internet of Vehicles Communication toward 6G

Blockchain-Envisioned Onion Routing Framework for Internet of Vehicles Communication toward 6G

Cyber Attack Detection in A Global Network Using Machine Learning Approach

In this digital age, inter-device communication is key to seamless and smooth handshaking. Communication can range from Internet of Things communication (IoT), autonomous vehicles, mobile communication and a plethora of other uses. These communications need to be protected against attacks. Unfortunately, with the widespread use of the internet, cyberattacks have become rampant. This research introduces the use of seven (7) machine- learning models alongside four different ensemble methods to compare the effectiveness of different Machine learning algorithms and ensemble models for intrusion detection. The network traffic was categorized as The Onion Router (TOR or non-TOR) traffic and further categorized if the network traffic data was Benign or Bot/Infiltration traffic data. This was achieved using: – Naïve Bayes, Decision Tree, K-Nearest Neighbor, Logistic Regression, Neural Network, Quadratic Discriminant Analysis, and Support Vector Machine. The ensemble models used are Adaboost, Gradient Boosting, Random Forest, and Max Voting. The "CIC IDS 2017", ("CSE-CIC-IDS2018"), "01-03-2018" and "02-03-2018" datasets were used. For dataset 1, among the regular machine learning models, Decision Trees had the highest values. Accuracy was 97.46% and precision was 89.88%. The highest ensemble performer was the Random Forest ensemble, which had an accuracy of 98.28% and a precision score of 93.20%. For dataset 2, Decision Trees also had the highest accuracy score of 99.86% and a precision score of 99.66%. The highest ensemble performer was the Random Forest ensemble which had an accuracy score of 99.89% and a precision score of 99.70%. For dataset 3, amongst the regular machine learning models, Neural Network had the highest accuracy score of 78.68% and a precision value of 72.92% while the highest ensemble performer was Gradient Boosting with an accuracy of 79.16% and a precision score of 81.25%.

Improve the Onion Routing Performance and Security with Cryptographic Algorithms

Onion Routing and Cryptographic Algorithms are two essential components of online privacy and secure data transmission. Onion Routing is a technique used to protect internet users' anonymity by routing their communication through a network of servers, while Cryptographic Algorithms are used to encrypt and decrypt data to ensure its confidentiality. As technology advances, there is a need to consider the development of new cryptographic algorithms for TOR to ensure its continued effectiveness. The combination of Onion Routing and Cryptographic Algorithms has proven to be an effective way to protect online privacy and security. This paper aims to explore the benefits of combining Onion Routing and Cryptographic Algorithms and to propose a hybrid symmetric and hashing algorithm technique to transmit data securely. By the end of this paper, researchers will have a comprehensive understanding of the Onion Routing and Cryptographic Algorithms, their implementation in TOR, and the limitations and risks associated with using such tools.

Detection of obfuscated Tor traffic based on bidirectional generative adversarial networks and vision transform

The Onion Router (TOR) network is a decentralized system of volunteer-run servers that aims to protect the anonymity and privacy of users by routing their internet traffic through a series of nodes. Individuals who use the TOR network may employ obfuscated traffic to conceal their internet activity from network administrators or security systems attempting to block or monitor them. Furthermore, some may use obfuscated Tor traffic to hide illegal activities, such as buying and selling illegal goods or accessing illegal services on the dark web. Despite efforts to identify and block Tor traffic, challenges remain, such as a limited set of features for identification, leading to false positives and negatives. To address these challenges, this paper proposes a novel approach using Visual Transformation (ViT), and augmentation by Bidirectional Generative Adversarial Networks (BiGAN). The proposed approach demonstrates superior performance on the ISCX-Tor2016 dataset, achieving 99.59% accuracy, 99.83% recall, 99.72% precision, and 99.78% F-score, thereby outperforming current state-of-the-art techniques.

Child sexual abuse material on the darknet

AbstractBy routing traffic through a random combination of servers worldwide, the darknet obfuscates the identity of its users, making it an attractive medium for journalists, dissidents, and individuals committing crimes. Since 2008, access to the darknet has been facilitated by the The Onion Router (TOR) browser, bringing the darknet within reach of an increasingly wider audience. Tens of thousands of darknet forums serve the criminal needs of millions of users each day and hundreds of these darknet forums are especially dedicated to the exchange of child sexual abuse materials (CSAM). Practitioners who work with men with sexual offences may therefore face individuals whose sexual offences occurred partly or wholly in the darknet. In the current review article, we summarize both the scientific literature and evidence obtained from CSAM forum “take-downs,” to describe the organization of darknet CSAM forums and the activities of their members. These forums report large and international memberships of individuals who, much like mainstream social media, interact online on a regular basis, creating large, online communities in which like-minded individuals can socialize and barter CSAM with minimal risk of discovery. Not all forum members contribute equally to the community, and especially administrators appear indispensable for the proper functioning of the CSAM forum. Implications for future research and law enforcement are discussed.

Examining the Hydra: Simultaneously Shared Links in Tor and the Effects on its Performance

Tor is a popular privacy-enhancing technology that allows anonymous communication using onion routing. However, such technologies are only helpful if used; therefore, performance is an important aspect. One of the main performance bottlenecks of Tor is the cross-circuit interference (CCI) problem. Tor multiplexes multiple circuits over a single Transport Layer Security (TLS) 1.2 connection if they share a path segment (link). Therefore, they have the same congestion window, which can yield unfair bandwidth allocation. However, there has been little work in understanding this problem in more depth. This paper investigates the number of simultaneously shared links in the current Tor network, which are the root cause of CCI. We developed a novel shared links simulator called SALSA to investigate this problem. Our results show that 3.7 % of active links are shared, and the involving Onion Routers (ORs) have the most common bandwidth capabilities. Additionally, we show that the internal circuits and exit policy influence the CCI problem. Furthermore, we model the number of shared links when the demand grows further and show that the number of shared links can go up to 16 %. Finally, we run Shadow simulations with a 25 % down-scaled Tor network and show that a network without shared links is faster.

Dark Web and Law Enforcement the Never-Ending Battle

Abstract: What is the Web? Is it Google? Or, Facebook? Emails, messenger, Yahoo? Well, these and all other forms that we are aware of barely constitute 4% of the whole world wide web! So, are we just looking at the tip of the iceberg? What constitutes the remaining 96% of the web? Let’s understand what 96% of our web consists of, there are 3 layers of the web 1) Surface Web 2) Deep, Web and 3) Dark Web .4% of the web that we use on a daily basis consists of the Surface Web which includes our Google, Facebook, WhatsApp, etc. The remaining 96% consist of Deep Web and Dark Web. Deep Web. As the name Dark Web the word Dark actually refers to secrets stored in dark, crime, illegal activities, and creepy things. Dark Web ca n be accessed through TOR (Onion Router). According to the statistics, the US citizen accounted for 34.81% of the Dark Web daily user count. It translates to 831,911 users. Russia took second place with 11.46%, and Germany ranked third with 7.16% of total active users. These are the statistics calculated for the year 2020

Online Videos Regarding Relevant Postoperative Patient Information and Postoperative Rehabilitation After Arthroscopic Rotator Cuff Repair Provide Poor Information Quality, Accuracy, and Reliability

To evaluate the information quality, accuracy, and reliability of YouTube videos regarding relevant postoperative patient information and postoperative rehabilitation after arthroscopic rotator cuff repair. By use of The Onion Router (TOR) software and predefined search terms, 102 videos were assessed. Four scoring systems were used to evaluate included videos: (1) Journal of the American Medical Association (JAMA) benchmark criteria score; (2) Global Quality Score (GQS); (3) DISCERN score; and (4) a newly developed score, the Rotator Cuff Score (RCS). The RCS (0-30 points) was built based on the latest published evidence and guidelines from the American Academy of Orthopaedic Surgeons. Videos that scored up to 9 points were regarded as poor-quality videos. Most of the included videos provided poor information quality, accuracy, and reliability. Videos that were uploaded by medically trained professionals showed significantly better results for all scores compared with commercial or personal-testimony videos (JAMA benchmark criteria score, P < .001; GQS, P < .001; DISCERN score, P= .001; and RCS, P= .001). Multivariate linear regression showed that the involvement of medically trained professionals was a significant predictor of better results for all scores (JAMA benchmark criteria score, β= 1.496 [P < .001]; GQS, β= 1.105 [P < .001]; DISCERN score, β= 11.234 [P < .001]; and RCS, β= 5.017 [P < .001]). Surprisingly, the like ratio was significantly higher for videos that were uploaded by non-medically trained individuals (P= .041). The average information quality, accuracy, and reliability of YouTube videos regarding relevant postoperative patient information and postoperative rehabilitation after arthroscopic rotator cuff repair are poor. Videos from medically trained professionals provide significantly higher information quality; however, even these videos lack important information for a better understanding of arthroscopic rotator cuff repair. Because of the lack of a peer-review process, available videos on YouTube regarding relevant postoperative patient information and postoperative rehabilitation after arthroscopic rotator cuff repair are of low quality, accuracy, and reliability. However, patients increasingly visit YouTube to gather medical knowledge. Physicians should enlighten patients about these findings and should be able to provide alternative sources of high-quality information.

TAVo: Tor Application Detection with Voting Critic

The Onion Router (TOR) Network, experiences an increasing number of users with an even more rapid increase in the volume of data usage. This leads to network congestion as well as a general decrease in end-user performance. TOR network is one of the solutions adopted by attackers that allows them to hide their identity through encryption. In this scenario, monitoring the applications and their traffic is a challenging task that can however bring relevant insights to network administrators and security teams. In this paper, we present a specially designed system to analyze the packet capture traffic of a network and classify each stream based on whether it is using the TOR network or not, as well as classifying the type of application using the TOR network. TOR Application detection with a Voting-classifier Critic (TAVo) uses a two-layer classifier that is combined with a specialized Critic model. The first layer aims at separating the Non-TOR from the TOR traffic, while the second layer determines the application that caused the TOR traffic. Whenever the second layer outputs a prediction with lower confidence the voting-classifier Critic is called to confirm or correct the predictions of these difficult cases. Through a set of experiments on a recent dataset, we show that TAVo has important advantages in terms of performance, achieving an average F1 score of 84% without the Critic model, and 91% with the Critic. Moreover, because the Critic model is only used for the cases where the base models face more difficulties, the overall system is efficient.