Characterizing the Redundancy of DarkWeb .onion Services

In Proceedings of the 14th International Conference on Availability, Reliability and Security (ARES 2019), 2019

Abstract

The Darkweb hosts a number of legal and illegal services that are hard to reach due to the lack, by design, of a regular 'name service' as those operated by DNSs on the clearnet. This difficulty, together with the continuous appearance of decoy mirror services and replicated domains, severely limits the investigation capabilities of researchers and law enforcement agencies interested in measuring the Darkweb phenomenon as a whole. To address this issue we developed MASSDEAL, a tool for the automated exploration of the Darkweb that automatically learns about new or previous unseen services and measures repeatedly across time and space (i.e. across multiple deployments of the same service). Relying on data collected over more than 20 thousand darkweb services sampled from September 2018 to January 2019, we perform and report an extensive analysis of service redundancy and measure the appearance of .onion mirrors as well as providing an estimation of the infrastructural redundancy behind those systems.

URL: https://doi.org/10.1145/3339252.3339273