Ph.D. Dissertation Defense “New Perspectives About the Tor Ecosystem: Integrating Structure with Information” By Mahdieh Zabihimayvan

Webex Meeting Link:

 https://wright.webex.com/wright/j.php?MTID=mf4a5c45c94cc04f9dd96f4fd61db258a

Ph.D. Committee:  Drs. Derek Doran, Advisor, Michael Raymer, Krishnaprasad Thirunarayan, and Amir Zadeh (Information Systems and Supply Chain Management)

ABSTRACT

Tor is the most popular dark network in the world. Its noble uses, including as a platform for free speech and information dissemination under the guise of true anonymity, make it an important socio-technical system in society. Although activities in socio-technical systems are driven by both structure and information, past studies on evaluating Tor investigate its structure or information exclusively and narrowly, which inherently limits our understanding of Tor. This dissertation bridges this gap by contributing insights into the logical structure of Tor, the types of information hosted on this network, and the interplay between its structure and information. These insights arise from three studies:

(a)  we perform a comprehensive crawl of the Tor dark Web and, through topic and net- work analysis, characterize the types of information and services hosted across a wide swath of Tor domains and their hyperlink relational structure. 


(b)  we study the potential for thought-to-be isolated information on the dark Web to be leaked into the public surface Web by providing a broad evaluation on the network of referencing from Tor to surface Web. 


(c)  we investigate the structural identity of Tor domains as an indicative of their neighborhood structure, independent of their either service type or location in the network. 


Our studies unearth previously unknown properties of Tor, including the finding that Tor domain types can be categorized into nine groups defined by the information they host. We unveil how services for releasing and searching information do emerge as the dominant type of Tor domains. Our importance evaluation identifies Dream marketplaces and directory domains as Tor core services and crucial entry points for probes, respectively. Connectivity analyses reveal some patterns of cooperation and competition among Tor domains. We also present measurements that indicate how some types of domains intentionally silo themselves from the rest of Tor.

The investigation on the dark-to-surface referencing network reveals this network as a single massive connected component where over 90% of Tor hidden services have at least one link to the surface world despite their interest in being isolated from surface Web tracking. This referencing puts Tor domains closer to each other and encourages them to cluster. However, it does not raise the domains’ contribution to either communication or information dissemination through the Tor network.

Analyses on the Tor structural identity indicate that Tor domains can be categorized into eight groups based on their neighborhood structure. Dream market has its own class: an almost fully connected neighborhood structure which is robust against node removal. Linking structure of Tor domains can further make differences in their structural identities. The domains with direct links to the others with high out-degree centrality form the dominant structural identity on Tor. This identity makes the 2nd-degree neighborhood of Tor domains robust against node removal or targeted attack despite their tendency towards isolation.