Target Detection of Dark web Hidden Services Network through MoniTOR and Social Network Analysis

The use of TOR tends to offer more anonymity than the surface web, especially between specific users and individual site hosts. However, the connecting practices used by individuals who build TOR sites establish a structure that not only enables users to navigate between various material sources but also permits examination of the Dark Net’s core organizational principles. The study employs a new Dark web navigation tool (MoniTOR) in conjunction with a tried-and-true approach used in criminological research. The purpose of the research is to use MoniTOR’s data collection technique to reconstruct a network of Dark web actors or sites using Social Network Analysis. SNA is an effective methodology that can be used to examine the connections and interconnections inside the Dark web. A network of more than 682,000 TOR hidden services (including domains and subdomains) was found by looking at connections between TOR sites that MoniTOR had logged. More than 500,000 of these domains joined to form a single enormous component that accounted for 73 percent of observed nodes and 79 percent of reported connections between sites. This information can be used to have a better understanding of how hidden services of interest are positioned in the Dark web, even spotting new potential threats or illegal activities. Through this evidence-based approach, it will be possible to apply a targeted network disruption strategy.