Recognition of service domains on TOR dark net using perceptual hashing and image classification techniques
R. Biswas, Eduardo Fidalgo, Enrique Alegre · 2017
One of the main features of TOR, the most known Dark Net from the Deep Web, is the high level of anonymity that provides to its users. State-of-the-art researches demonstrated that TOR network exhibits a wide range of legal and illegal services and activities like file-sharing, ransomware panels or the counterfeit of goods among others. In this paper, we present a framework to recognize some of the previously mentioned services on TOR through their image content. Firstly, we introduce and make publicly available DUSI (Darknet Usage Service Images), an image-based dataset containing snapshots from active TOR domains of six different service categories. Using DUSI, we have evaluated two pipelines based on Perceptual Hashing and Bag of Visual Words (BoVW). In the first one, the hash code is computed and then compared through the Hamming Distance with previously stored hashes representing each service. In the second pipeline, multiple SVM models are trained with BoVW feature vectors coded with SIFT and Edge-SIFT descriptors, standalone and combined. During the classification stage, each new snapshot is encoded by using the corresponding dictionary and classified by the trained models. The highest accuracy obtained, 99.38%, and the fact that it does not need a trained model, makes perceptual hashing the recommended approach to detect TOR services through a snapshot of their home pages.