The Tor darknet hosts different types of illegal content, which are monitored by cybersecurity agencies. However, manually classifying Tor content can be slow and error-prone. To support this task, we introduce Frequency-Dominant Neighborhood Structure (F-DNS), a new perceptual hashing method for automatically classifying domains by their screenshots. First, we evaluated F-DNS using images subject to various content preserving operations. We compared them with their original images, achieving better correlation coefficients than other state-of-the-art methods, especially in the case of rotation. Then, we applied F-DNS to categorize Tor domains using the Darknet Usage Service Images-2K (DUSI-2K), a dataset with screenshots of active Tor service domains. Finally, we measured the performance of F-DNS against an image classification approach and a state-of-the-art hashing method. Our proposal obtained 98.75% accuracy in Tor images, surpassing all other methods compared.
@article{arxiv.2005.10090,
title = {Perceptual Hashing applied to Tor domains recognition},
author = {Rubel Biswas and Roberto A. Vasco-Carofilis and Eduardo Fidalgo Fernandez and Francisco Jáñez Martino and Pablo Blanco Medina},
journal= {arXiv preprint arXiv:2005.10090},
year = {2020}
}
Comments
To be published on the JNIC 2020 Conference. Already published research summary