Perceptual Hashing applied to Tor domains recognition

TL;DR

This paper introduces F-DNS, a novel perceptual hashing technique that effectively classifies Tor domain screenshots, achieving high accuracy and outperforming existing methods, thereby aiding cybersecurity efforts against illegal darknet content.

Contribution

The paper presents F-DNS, a new perceptual hashing method tailored for classifying Tor domain images, demonstrating superior accuracy over existing approaches.

Findings

F-DNS achieved 98.75% accuracy in classifying Tor images.

F-DNS outperformed state-of-the-art hashing methods and image classification approaches.

F-DNS maintained robustness under various content-preserving image transformations.

Abstract

The Tor darknet hosts different types of illegal content, which are monitored by cybersecurity agencies. However, manually classifying Tor content can be slow and error-prone. To support this task, we introduce Frequency-Dominant Neighborhood Structure (F-DNS), a new perceptual hashing method for automatically classifying domains by their screenshots. First, we evaluated F-DNS using images subject to various content preserving operations. We compared them with their original images, achieving better correlation coefficients than other state-of-the-art methods, especially in the case of rotation. Then, we applied F-DNS to categorize Tor domains using the Darknet Usage Service Images-2K (DUSI-2K), a dataset with screenshots of active Tor service domains. Finally, we measured the performance of F-DNS against an image classification approach and a state-of-the-art hashing method. Our proposal obtained 98.75% accuracy in Tor images, surpassing all other methods compared.