Classifying Illegal Activities on Tor Network Based on Web Textual Contents

Proceedings of the 15th Conference of the European Chapter of the Association for Computational Linguistics: Volume 1, Long Papers, pages 35–43, Valencia, Spain, April 3-7, 2017. c⃝2017 Association for Computational Linguistics Classifying Illegal Activities on Tor Network Based on Web Textual Contents Mhd Wesam Al Nabki1,2, Eduardo Fidalgo1,2, Enrique Alegre1,2, and Ivan de Paz1,2 1Department of Electrical, Systems and Automation, University of Le´on, Spain 2 Researcher at INCIBE (Spanish National Cybersecurity Institute), Le´on, Spain {mnab, eduardo.fidalgo, ealeg, ivan.paz.centeno}@unileon.es Abstract The freedom of the Deep Web offers a safe place where people can express them- selves anonymously but they also can conduct illegal activities. In this pa- per, we present and make publicly avail- able1 a new dataset for Darknet active do- mains, which we call it ”Darknet Usage Text Addresses” (DUTA). We built DUTA by sampling the Tor network during two months and manually labeled each ad- dress into 26 classes. Using DUTA, we conducted a comparison between two well-known text representation techniques crossed by three different supervised clas- sifiers to categorize the Tor hidden ser- vices. We also fixed the pipeline ele- ments and identified the aspects that have a critical influence on the classification re- sults. We found that the combination of TF-IDF words representation with Logis- tic Regression classifier achieves 96.6% of 10 folds cross-validation accuracy and a macro F1 score of 93.7% when clas- sifying a subset of illegal activities from DUTA. The good performance of the clas- sifier might support potential tools to help the authorities in the detection of these ac- tivities. 1 Introduction If we think about the web as an ocean of data, the Surface Web is no more than the slight waves that float on the top. While in the depth, there is a lot of sunken information that is not reached by the traditional search engines. The web can be divided into Surface Web and Deep Web. The Surface Web is the portion of the web that can be crawled and 1The dataset is available upon request to the first author (email). indexed by the standard search engines, such as Google or Bing. However, despite their existence, there is still an enormous part of the web remained without indexing due to its vast size and the lack of hyperlinks, i.e. not referenced by the other web pages. This part, that can not be found using a search engine, is known as Deep Web (Noor et al., 2011; Boswell, 2016). Additionally, the con- tent might be locked and requires human interac- tion to access e.g. to solve a CAPTCHA or to en- ter a log-in credential to access. This type of web pages is referred to as ”database-driven” websites. Moreover, the traditional search engines do not ex- amine the underneath layers of the web, and con- sequently, do not reach the Deep Web. The Dark- net, which is also known as Dark Web, is a subset of the Deep Web. It is not only not indexed and isolated, but also requires …

Content truncated to 500 words