Development of a Traffic Fingerprinting-Based Hidden Service Access Identification System for Dark Web Drug Investigations
Sol Gyu Park, Jiyeon Kim · IEEE Access · 2026
Advances in cryptographic technologies for information security have led to the emergence of anonymous communication systems such as Tor. While the Tor network contributes to privacy protection and freedom of expression, it is also exploited for illicit activities, including drug trafficking, child sexual exploitation, and illegal financial or weapons transactions. Consequently, investigative agencies require new technical approaches capable of identifying user access behaviors within anonymous networks. This study proposes a system for identifying connections to dark web drug marketplaces based on Tor network traffic analysis. The proposed system leverages raw traffic obtained from network bridge segments accessible to investigators and incorporates a realistic data preprocessing pipeline consisting of Tor Metrics–based filtering, user–operator distinction, and guard-node–level traffic separation. From the refined traffic, we extract core features—Burst-Cycle, Distribution-Entropy, and TCP/TLS sequence patterns—and transform them into fixed-length vectors suitable for machine learning. We incrementally increased the number of identifiable dark web sites to compare machine learning and deep learning models. Among the evaluated models, the CNN classifier achieved the highest performance, maintaining an accuracy of approximately 0.90 in the seven-class classification setting. These findings demonstrate the effectiveness of the proposed framework under the evaluated experimental setting and suggest its potential usefulness for inferring a suspect’s access to monitored dark web drug sites.