Towards a Conceptual Typology of Darknet Risks Ogbanufe, Obi; Wolfe, Jordan; Baucum, Fallon
The Journal of computer information systems,
07/2024, Letnik:
ahead-of-print, Številka:
ahead-of-print
Journal Article
Recenzirano
Increased rewards and reduced risks drive illicit networks. Cybercriminals seek to avoid risks, including detection, arrests, sanctions, and violence. Hence, they employ several strategies to avoid ...operational risks when accessing darknet sites, communicating, making payments, shipping and delivery, and resolving disputes. Each operation involves transactions that should work together, such that when a transaction is disrupted, it increases its risk and reduces the crime's benefits. In this study, we examine these risks, and their avoidance strategies, in an attempt to highlight transactions that could be disrupted. We develop a typology of darknet risks, a parsimonious conceptual model abstracted from the literature on risk originators (internal or external) and risk targets (vendors or buyers). This study further clarifies how risk avoidance strategies may be disrupted to increase the risks and reduce the reward of darknet crime.
Today, the Internet security community largely emphasizes cyberspace monitoring for the purpose of generating cyber intelligence. In this paper, we present a survey on darknet. The latter is an ...effective approach to observe Internet activities and cyber attacks via passive monitoring. We primarily define and characterize darknet and indicate its alternative names. We further list other trap-based monitoring systems and compare them to darknet. Moreover, in order to provide realistic measures and analysis of darknet information, we report case studies, namely, Conficker worm in 2008 and 2009, Sality SIP scan botnet in 2011, and the largest amplification attack in 2014. Finally, we provide a taxonomy in relation to darknet technologies and identify research gaps that are related to three main darknet categories: deployment, traffic analysis, and visualization. Darknet projects are found to monitor various cyber threat activities and are distributed in one third of the global Internet. We further identify that Honeyd is probably the most practical tool to implement darknet sensors, and future deployment of darknet will include mobile-based VOIP technology. In addition, as far as darknet analysis is considered, computer worms and scanning activities are found to be the most common threats that can be investigated throughout darknet; Code Red and Slammer/Sapphire are the most analyzed worms. Furthermore, our study uncovers various lacks in darknet research. For instance, less than 1% of the contributions tackled distributed reflection denial of service (DRDoS) amplification investigations, and at most 2% of research works pinpointed spoofing activities. Last but not least, our survey identifies specific darknet areas, such as IPv6 darknet, event monitoring, and game engine visualization methods that require a significantly greater amount of attention from the research community.
Cyber Threat Intelligence(CTI) plays an indispensable role in providing evidence-based knowledge to plan defensive strategies against advanced cyber attacks. Most threat intelligence data originate ...from security researchers, vendor blogs, list of threat indicators, and commercial cyber security firms. However, as attack surfaces become more dynamic and threat actors shift towards organization/sector-specific attacks, generic threat information is no longer adequate to safeguard against these targeted attacks. In such scenarios, darknet data can be an invaluable source of threat information at the enterprise level as in darknet, the traffic is destined for a range of unused IP addresses. As these IP addresses are unused, the traffic destined for them is considered suspicious and can serve as a valuable source for threat intelligence. Darknet monitoring is done in either active or passive mode. Passive darknet monitoring gives generic information without active engagement with the attacker devices. So, we developed a novel method for gathering threat intelligence via active darknet monitoring by designing a kernel-level darknet sensor that engages incoming traffic by establishing a 3-way handshake. We called it DARK-KERNEL in our previous work. This work aims to implement DARK-KERNEL as a Service (DKaaS) for organization-level threat intelligence. To achieve this, we deploy the DARK-KERNEL by assigning four unused public IP addresses. We gather 37 days of traffic and provide a comprehensive analysis of captured data using Security Onion and several automated scripts. In addition, we highlight a few attacks to define the effectiveness of DKaaS. Finally, we propose a novel framework that integrates DKaaS with a customizable Security Orchestration and Response (SOAR) engine to deploy behavioral honeypots to lure sophisticated attackers.
The ebook edition of this title is Open Access and freely available to read online. Transnational illicit markets have been transformed by the digital revolution. They take advantage of encryption ...technologies, smartphones, social media applications and cryptocurrencies that protect the digital traces of buyers and sellers, posing new challenges to drug control policies and public health alike. Digital Transformations of Illicit Drug Markets: Reconfiguration and Continuity considers how the digital revolution has changed the selling and buying of illicit substances through increased convenience and anonymisation. Providing a uniquely interdisciplinary perspective, chapters show how the digital transformation of illicit drug markets combines a reconfiguration of how sellers and buyers interact in new markets. Emphasising that illicit digital markets are embedded in societal structures and power relations in general, contributors also recognise the importance of critical perspectives on inequalities between the Global North and South as well as issues of gender. Digital Transformations of Illicit Drug Markets: Reconfiguration and Continuity challenges the field of criminology to recognise the limits of its traditional knowledge and move beyond the preoccupations that restrict crime to certain fixed spaces in order to develop new explanations.
Darknet and the Political Yakovlev, Maksim V.
Vestnik Rossijskogo universiteta družby narodov. Seriâ Politologiâ,
09/2022, Letnik:
24, Številka:
3
Journal Article
Recenzirano
Odprti dostop
The Darknet is becoming an increasingly visible structural unit in the political sphere and at the same time remains a little-studied area of cyberspace. Therefore, the article aims to determine the ...conceptual prism for its consideration and its actual significance in the measurement of the political. With the help of comparative historical analysis, the study reveals the causes and time of the political birth of the Darknet, characterizes its resources and political role through system and content analysis, systematizes and clarifies the concepts of power and politics in the Network based on the provisions of R. Gel, M. Castels, K. Schmitt, etc. The author names the expansion of states (especially autocracies) in the digital space as the main factor in the politicization and transformation of the Darknet. The pressure of power and dominance systems aimed at maintaining sovereignty and control in cyberspace caused “digital resistance” of programmers and users seeking free data exchange and confidentiality, as well as civil activists who strived to avoid prosecution for dissent, which led to the renewed architecture and functionality of the Darknet, its transformation into an alternative space of informational interaction and a database to build up the opposition potential. Criminals also took advantage of the opportunities of the new network for their own purposes. The main result of the research is the thesis that the Darknet is being transformed into a special socio-technical system that is outside the sphere of international and state law, where all interactions are carried out exclusively through private agreements between clients, with an alternative world payment system based on cryptocurrencies.
Object detection is a critical and complex problem in computer vision, and deep neural networks have significantly enhanced their performance in the last decade. There are two primary types of object ...detectors: two stage and one stage. Two-stage detectors use a complex architecture to select regions for detection, while one-stage detectors can detect all potential regions in a single shot. When evaluating the effectiveness of an object detector, both detection accuracy and inference speed are essential considerations. Two-stage detectors usually outperform one-stage detectors in terms of detection accuracy. However, YOLO and its predecessor architectures have substantially improved detection accuracy. In some scenarios, the speed at which YOLO detectors produce inferences is more critical than detection accuracy. This study explores the performance metrics, regression formulations, and single-stage object detectors for YOLO detectors. Additionally, it briefly discusses various YOLO variations, including their design, performance, and use cases.
Aims
To investigate the prevalence of awareness of the online illicit drug marketplace Silk Road (SR), consumption of drugs purchased from SR and reasons for use and non‐use of SR.
Design and setting
...Global Drug Survey: purposive sample collected in late 2012.
Participants
The base sample (n = 9470) reported recent drug purchase and resided in the United Kingdom (n = 4315, median age 24, 76% male), Australia (n = 2761, median age 32, 76% male) or the United States (n = 2394, median age 21, 80% male).
Measurements
Online questionnaire.
Findings
A total of 65% of US, 53% of Australian and 40% of UK respondents had heard of SR; 18% of US, 10% of UK and 7% of Australian respondents had consumed drugs purchased through SR. Across the three countries, 3,4‐methylenedioxy‐N‐methylamphetamine (MDMA) was the most commonly purchased drug (53–60%), followed by cannabis (34–51%), lysergic acid diethylamide (LSD) (29–45%) and the 2C family (16%–27%). The most common reasons for purchasing from SR were wider range (75–89%), better quality (72–77%), greater convenience (67–69%) and the use of vendor rating systems (60–65%). The most common reasons for avoiding SR purchase were adequate drug access (63–68%) and fear of being caught (41–53%). Logistic regressions found that, compared with people from the UK, Australians odds ratio (OR) = 3.37; 95% confidence interval (CI) = 2.29, 4.97) and Americans (OR = 1.46; 95% CI = 1.10, 1.94) were more likely to use SR due to lower prices; and to avoid SR purchase due to fear of being caught (Australia: OR = 1.65; 95% CI = 1.39, 1.96; USA: OR = 1.62; 95% CI = 1.37, 1.92).
Conclusions
While reasons for Silk Road use accord with broader online commerce trends (range, quality, convenience, ratings), its appeal to drug purchasers is moderated by country‐specific deterrents and market characteristics.
Hidden services are a feature of Tor(The Onion Router)1. It provides anonymity for the service requester while maintaining the anonymity of the service provider. Since it is quite difficult to trace ...back and locate both parties in the communication, the criminals use hidden services mechanisms to construct various illegal activities in the darknet, which has brought adverse effects to society. In order to prevent the abuse of Tor hidden services, the discovery and analysis of hidden services are particularly important. The aim of this survey paper is to review and compare the literature of the past five years, provide the readers with methods for discovering tor hidden services, along with the various content analysis methods developed and proposed from time to time. we explain their key ideas and show their interrelations.
Glaucoma disease in humans can lead to blindness if it progresses to the point where it affects the oculus' optic nerve head. It is not easily detected since there are no symptoms, but it can be ...detected using tonometry, ophthalmoscopy, and perimeter. However, advances in artificial intelligence approaches have permitted machine learning techniques to diagnose at an early stage. Numerous methods have been proposed using Machine Learning to diagnose glaucoma with different data sets and techniques but these are complex methods. Although, medical imaging instruments are used as glaucoma screening methods, fundus imaging specifically is the most used screening technique for glaucoma detection. This study presents a novel DenseNet and DarkNet combination to classify normal and glaucoma affected fundus image. These frameworks have been trained and tested on three data sets of high‐resolution fundus (HRF), RIM 1, and ACRIMA. A total of 658 images have been used for healthy eyes and 612 images for glaucoma‐affected eyes classification. It has also been observed that the fusion of DenseNet and DarkNet outperforms the two CNN networks and achieved 99.7% accuracy, 98.9% sensitivity, 100% specificity for the HRF database. In contrast, for the RIM1 database, 89.3% accuracy, 93.3% sensitivity, 88.46% specificity has been attained. Moreover, for the ACRIMA database, 99% accuracy, 100% sensitivity, 99% specificity has been achieved. Therefore, the proposed method is robust and efficient with less computational time and complexity compared to the literature available.
A novel combination of DenseNet and DarkNet convolutional neural network (CNN) models are proposed to classify normal and glaucoma fundus images using three data sets of high‐resolution fundus (HRF), RIM 1, and ACRIM. Fusion of both models outperforms on each data set.
Interconnection Between Darknets Cilleruelo, Carlos; de-Marcos, Luis; Junquera-Sanchez, Javier ...
IEEE internet computing,
2021-May-June-1, 2021-5-1, Letnik:
25, Številka:
3
Journal Article
Recenzirano
Tor and i2p networks are two of the most popular darknets. Both darknets have become an area of illegal activities highlighting the necessity to study and analyze them to identify and report illegal ...content to law enforcement agencies (LEAs). This article analyzes the connections between the Tor network and the i2p network. We created the first dataset that combines information from Tor and i2p networks. The dataset contains more than 49k darknet services. The process of building and analyzing the dataset shows that it is not possible to explore one of the networks without considering the other. Both networks work as an ecosystem and there are clear paths between them. Using graph analysis, we also identified the most relevant domains, the prominent types of services in each network, and their relations. Findings are relevant to LEAs and researchers aiming to crawl and investigate i2p and Tor networks.
PDF
