Onion under Microscope: An in-depth analysis of the Tor network

TL;DR

This paper provides an in-depth analysis of the structure and properties of the Tor Web graph, examining its global and local features over time to understand its unique characteristics and content-structure relationships.

Contribution

It offers the first comprehensive study of the Tor Web's graph structure, considering volatility and content relationships, based on extensive crawling datasets.

Findings

Tor Web exhibits distinct global and local graph properties compared to surface Web.

Volatility significantly impacts the stability of the Tor Web graph.

Content features are related to specific topological roles of services.

Abstract

Tor is an anonymity network that allows offering and accessing various kinds of resources, known as hidden services, while guaranteeing sender and receiver anonymity. The Tor web is the set of web resources that exist on the Tor network, and Tor websites are part of the so-called dark web. Recent research works have evaluated Tor security, evolution over time, and thematic organization. Nevertheless, few information are available about the structure of the graph defined by the network of Tor websites. The limited number of Tor entry points that can be used to crawl the network renders the study of this graph far from being simple. In this paper we aim at better characterizing the Tor Web by analyzing three crawling datasets collected over a five-month time frame. On the one hand, we extensively study the global properties of the Tor Web, considering two different graph representations and verifying the impact of Tor's renowned volatility. We present an in depth investigation of the key features of the Tor Web graph showing what makes it different from the surface Web graph. On the other hand, we assess the relationship between contents and structural features. We analyse the local properties of the Tor Web to better characterize the role different services play in the network and to understand to which extent topological features are related to the contents of a service.