The darknet's smaller than we thought: The life cycle of Tor Hidden Services

Abstract

The Tor Darknet is a pseudo-anonymous place to host content online frequently used by criminals to sell narcotics and to distribute illicit material. Many studies have attempted to estimate the size of the darknet, but this paper will show that previous estimates on size are inaccurate due to hidden service lifecycle. The first examination of its kind will be presented on the differences between short-lived and long-lived hidden services. Finally, in light of a new Tor protocol for the darknet which will prevent the running of relays to learning darknet sites, an analysis is presented of the use of crawling and whether this is an effective mechanism to discover sites for law enforcement.

Tor Hidden Services: A Systematic Literature Review

“…Performance and deficiencies [65], [66], [67], [68], [69] 5 Changes in the design [69], [70], [71], [61], [72], [73] 6 Discovery and measurement [74], [75], [32], [33], [34], [37], [38], [68], [23], [30], [31], [19] 12…”

“…Taking into account Owen and Savage's work that exposes the short life of the services in Tor, Owenson [75] indicates that the Dark Web is much smaller than many people think, since most Onion Services do tend to be ephemeral, so they do not all coexist at once.…”

“…Another deficiency found is the lack of evidence in a realistic environment. Many of the attacks are considered successful when tested in simulated environments and are rarely brought to the real Tor network [19,29,42,53,54,56,61,73,75], among others. Panchenko et al [50] present a fingerprinting attack that is theoretically fully functional but, when was brought to the real environment, it has a very low recognition rate.…”

Tor Hidden Services: A Systematic Literature Review

“…Taking into account Savage and Owen's work [34] that exposed the short lifetimes of the services in Tor, Owenson et al [82] indicated that the dark web is much smaller than many people think, since most onion services do tend to be ephemeral, so they do not all coexist at once.…”

“…Another deficiency found is the lack of evidence in a realistic environment. Many of the attacks are considered successful when tested in simulated environments and are rarely brought to the real Tor network [25,43,53,55,61,64,65,80,82]. Panchenko et al [68] presented a fingerprinting attack that is theoretically fully functional, but when brought to the real environment, had a very low recognition rate.…”