The anonymous nature of darknets is commonly exploited for illegal activities. Previous research has employed machine learning and deep learning techniques to automate the detection of darknet ...traffic in an attempt to block these criminal activities. This research aims to improve darknet traffic detection by assessing a wide variety of machine learning and deep learning techniques for the classification of such traffic and for classification of the underlying application types. We find that a Random Forest model outperforms other state-of-the-art machine learning techniques used in prior work with the CIC-Darknet2020 dataset. To evaluate the robustness of our Random Forest classifier, we obfuscate select application type classes to simulate realistic adversarial attack scenarios. We demonstrate that our best-performing classifier can be degraded by such attacks, and we consider ways to effectively deal with such adversarial attacks.
Functional classification of bitcoin addresses Febrero-Bande, Manuel; González-Manteiga, Wenceslao; Prallon, Brenda ...
Computational statistics & data analysis,
20/May , Letnik:
181
Journal Article
Recenzirano
Odprti dostop
A classification model for predicting the main activity of bitcoin addresses based on their balances is proposed. Since the balances are functions of time, methods from functional data analysis are ...applied; more specifically, the features of the proposed classification model are the functional principal components of the data. Classifying bitcoin addresses is a relevant problem for two main reasons: to understand the composition of the bitcoin market, and to identify addresses used for illicit activities. Although other bitcoin classifiers have been proposed, they focus primarily on network analysis rather than curve behavior. The proposed approach, on the other hand, does not require any network information for prediction. Furthermore, functional features have the advantage of being straightforward to build, unlike expert-built features. Results show improvement when combining functional features with scalar features, and similar accuracy for the models using those features separately, which points to the functional model being a good alternative when domain-specific knowledge is not available.
Cryptocurrencies and Business Ethics Dierksmeier, Claus; Seele, Peter
Journal of business ethics,
09/2018, Letnik:
152, Številka:
1
Journal Article
Recenzirano
Cryptocurrencies such as Bitcoin, SETLcoin, Ether, Solar Coin, or Liberty Reserve exist since 2009. Because of their decentralized control, they are often considered a threat or alternative to the ...conventional centralized banking system. While the technological implication of some such currencies, especially of Bitcoin, has attracted much attention, so far there is little discussion about the entire field of cryptocurrencies and very little academic literature addressing its ethical significance. In this article, we thus address the impact of "blockchain technology" on the nature of financial transactions from a business ethics perspective. We begin with a survey on relevant literature from neighboring disciplines. Next, we work towards a 3 × 3 framework for current debates on the ethics of cryptocurrencies (see Table 1): we combine the micro, meso, and macro levels of business and society with assessments of the potential ethical impact of cryptocurrencies as morally beneficial, detrimental, and ambiguous. In addition, we highlight possible avenues for future research, such as the changing roles of the miners and regulators, the prosocial use of cryptocurrencies, the antisocial use for shadow banking and transactions in the 'dark net' and cryptocurrencies' effect on inflation and deflation.
Dijitalleşme ile suç dünyası da dijital bir hale gelmiştir ve internet üzerinden işlenen suçların sayısı her geçen gün artmaktadır. Siber suçlular ve saldırganlar kimliklerini gizlemek ve şifreli ...iletişim sağlamak için Karanlık Ağ adı verilen ve internet üzerinde bulunan gizli ağları kullanmaktadırlar. Karanlık Ağlar normal internet altyapısından farklı ve özel erişim yöntemlerine sahiptirler. Bu ağlara yapılan tüm erişimler şüphelidir ve incelenmesi gerekmektedir. Karanlık Ağ, şifreli iletişim sağladığı için günümüz güvenlik araçları ile tespit edilmesi ve sınıflandırılması zordur. Bu çalışmada şifreli ağ trafiği deşifreleme işlemi yapılmadan sadece paketlerin istatistiki bilgileri makine öğrenmesi yaklaşımı kullanılarak analiz edilmiştir. Veri seti olarak açık kaynak olan CICDarknet2020 veri seti kullanılmıştır. Paket analizi için K En Yakın Komşu, Lojistik Regresyon, Rassal Orman, SVM, Karar Ağacı, Gaussian Naive Bayes, Doğrusal Ayrımcı Analiz, Gradyan Artırma, Ekstra Ağaç ve XGBoost algoritmalarını kapsayan detaylı bir deneysel çalışma gerçekleştirilmiştir. Yapılan deneysel çalışmalarda Karar Ağacı algoritmasının %93,32 doğruluk oranı ile en yüksek sınıflandırma başarısına sahip olduğu görülmüştür.
Darknet traffic classification is crucial for identifying anonymous network applications and defensing cyber crimes. Although notable research efforts have been dedicated to classifying darknet ...traffic by combining machine learning algorithms and elaborately designed features, current methods either heavily depend on hand-crafted features or overlook the global intrinsic relationships among the local features automatically extracted from different data positions, leading to limited classification performance. To tackle this issue, we propose DarknetSec, a novel self-attentive deep learning method for darknet traffic classification and application identification. Concretely, DarknetSec utilizes a cascaded model with a 1-dimensional Convolutional Neural Network (1D CNN) and a bidirectional Long Short-Term Memory (Bi-LSTM) network to capture local spatial-temporal features from the payload content of packets, while the self-attention mechanism is integrated into the abovementioned feature extraction network to mine the intrinsic relationships and hidden connections among the previously extracted content features. In addition, DarknetSec extracts side-channel features from payload statistics to enhance its classification performance. We evaluate DarknetSec on the CICDarknet2020 dataset, which is a representative of darknet traffic covering both Virtual Private Network (VPN) and The Onion Router (Tor) applications. Thorough experiments show that DarknetSec is superior to other state-of-the-art methods, achieving a multiclass accuracy of 92.22% and a macro-F1-score of 92.10%. Additionally, DarknetSec maintains its high accuracy when applied to other encrypted traffic classification tasks.
In the twenty-first century, several negative moments have accompanied many positive technological progress events. With the development of the digital world, criminals with special knowledge – ...cybercriminals have become active and have developed many means in the depths of cyberspace, with the help of which they achieve their criminal and illegal goals. The presented paper aims to analyze in detail and in-depth the system and working principles of digital black markets created by cybercriminals on the dark side of the Internet. The paper also looks at what tools and products are available on the digital black market and why digital black markets are hazardous to operate successfully. The paper analyzes practical cases, legal studies, and other interdisciplinary studies to present the problems in the legal struggle against digital black markets as of the day it was written. The paper’s primary purpose is to show why the unimpeded functioning of digital black markets on the dark web is dangerous – both for the ordinary citizen and the state structures. In the final part of the article, based on the analysis of the processed literature and practical cases, recommendations will be presented, the use of which is of particular importance to make the legal fight against digital black markets successful and to prevent such a dangerous phenomenon as digital black markets from existing in any part of the digital world.
In order to address the problem that the capsule network can not classify complex small sample images effectively, a classification model is proposed on the basis of fusing the improved Darknet with ...the capsule network. Firstly, the Darknet is upgraded containing both the shallow level extractor and the deep level extractor. The shallow level extractor adopts a 5×5 convolution kernel to capture long-distance edge contour features and the deep level extractor uses a 3×3 convolution kernel to capture deeper semantic features. Then, the extracted edge features and semantic features are fused to preserve effective features of images. Next, the capsule network is used to vectorize these effective features to work out the loss of spatial representation. Finally, L2 regularization is added in the loss function to avoid the over-fitting. Experimental results show that, on the small sample dataset, the classification accuracy of the proposed model is 28.51 percentage points and 24.40 percentage points higher than that
Do heightened privacy perceptions, censorship concerns and exposure to online crime affect people’s level of opposition to dual-use technologies such as the Dark Web? If they do, then how much do ...these factors actually drive baseline levels of opposition to the Dark Web? Do privacy and censorship concerns get amplified in regimes with significant Internet restrictions? Does Internet freedom itself affect people’s baseline levels of opposition to Tor and other Dark Web technologies? Using new survey data on 17,121 Internet users in 17 different countries, a series of mixed-effect order logit regressions reveal that privacy and censorship concerns are both significant predictors of less opposition to the Dark Web. Past exposure to online crime, in contrast, significantly increases opposition to the Dark Web. Interestingly, restrictions on Internet freedom do not amplify privacy and censorship concerns, but Internet freedom itself is related to baseline levels of opposition to the Dark Web forming an inverted-U-shaped pattern.
Tor onion services can be accessed and hosted anonymously on the Tor network.We analyze the protocols, software types, popularity and uptime ofthese services by collecting a large amount of .onion ...addresses. Websites arecrawled and clustered based on their respective language. In order to alsodetermine the amount of unique websites a de-duplication approach is implemented.To achieve this, we introduce a modular system for the real-timedetection and analysis of onion services. The overall data revealsthat a large amount of permanent services provide no actual content for Torusers. A significant part consists instead of bots, services offered via multipledomains, or duplicated websites for phishing attacks. The total amount ofonion services is thus significantly smaller than current statistics suggest
•A new dataset for the hidden services in the Tor network with 10K samples.•Statistical analysis for the dataset with useful insights for Law Enforcement Agencies.•A new algorithm for ranking the ...onion domains and detect the influential ones.•The algorithm is tested on three real-world datasets.
The Tor network hosts a significant amount of hidden services related to suspicious activities. Law Enforcement Agencies need to monitor and to investigate crimes hidden behind the anonymity provided by Tor. In this paper, we propose a new algorithm, named ToRank, that ranks hidden services in Tor better than the known algorithms used for the Surface Web. We also thoroughly analyze the content present in Tor, creating a dataset, DUTA-10K, that extends the previous Darknet Usage Text Address (DUTA) dataset. We quantitatively compared ToRank with some of the most popular ranking algorithms, like PageRank, HITS, and Katz. Results showed that our proposal obtains a higher harm to the Tor network robustness than all of them, what indicates its superiority for this problem. The analysis of DUTA-10K reveals that only 20% of the hidden services that can be accessed are related to suspicious activities, and 48% are associated with normal ones. We also discovered that domains related to suspicious activities usually present multiple clones under different addresses, what could be used as an additional feature for identifying them. We consider that our new algorithm, the extended dataset, and the findings obtained from the analysis carried out are helpful for LEAs to fight against crimes that take place in the Tor hidden services.
PDF
