Dark Web Forensics: An Investigation of Tracking Dark Web Activity with Digital Forensics

Brinson, Robert G.; Wimmer, Hayden; Chen, Lei

doi:10.1109/irtm54583.2022.9791646

Cited by 4 publications

(6 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The deep web and the dark web are often confused, but they are distinct concepts, each with its own characteristics and implications for cybercrime [2]. The deep web comprises any part of the Internet not indexed by search engines, and it can include legal and legitimate content.…”

Section: Research Contextmentioning

confidence: 99%

“…Through primary, traditional web browsers, and an Internet connection, users can access websites for social networking, online shopping, video streaming, public news, research, and more via the "surface web" [17]. The crucial distinction between the "surface web" and the "clear web" is that the latter phrase refers to the portion of the Internet that can be indexed by any traditional search engine [2,5]. The deep web stands in opposition to the surface web.…”

Section: Related Workmentioning

confidence: 99%

“…However, some have made an effort to map this out. According to [2,14] research journals, browser forensic examinations focus on performing more conventional operations on the computer, such as database, RAM, network forensics, and registry. In contrast, dark web forensics should consolidate two fundamental areas: forensics connected to TOR activities and forensics linked to Bitcoin transactions [16].…”

Section: The Landscape Of Dark and Deep Web Forensicsmentioning

confidence: 99%

“…Users with more sinister and unlawful intentions are accessing areas of the Internet that are concealed from the public by being unindexed, as illustrated in Figure 1. In contrast, everyday Internet users access websites using a standard web browser, and the dark web uses numerous layers of encryption to encrypt all traffic, and services such as TOR, FREENET, WATERFOX, and TAILS are used to access it [2]. As a result of these layers of encryption, the dark web offers users a high level of anonymity [3,4].…”

Section: Introductionmentioning

confidence: 99%

“…The term "dark net" refers to the portion of the IP address space that is routable but not used [1]. The dark net is most associated with overlay networks that provide anonymous network connectivity and services [2]. In addition, the Invisible Internet Project (I2P) is an unknown peer-to-peer network layer that uses layered encryption and garlic routing, a variant of onion routing, to ensure the anonymity of communications [13].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

D2WFP: A Novel Protocol for Forensically Identifying, Extracting, and Analysing Deep and Dark Web Browsing Activities

Ghanem,

Mulvihill,

Ouazzane

et al. 2023

JCP

View full text Add to dashboard Cite

The use of the unindexed web, commonly known as the deep web and dark web, to commit or facilitate criminal activity has drastically increased over the past decade. The dark web is a dangerous place where all kinds of criminal activities take place, Despite advances in web forensic techniques, tools, and methodologies, few studies have formally tackled dark and deep web forensics and the technical differences in terms of investigative techniques and artefact identification and extraction. This study proposes a novel and comprehensive protocol to guide and assist digital forensic professionals in investigating crimes committed on or via the deep and dark web. The protocol, named D2WFP, establishes a new sequential approach for performing investigative activities by observing the order of volatility and implementing a systemic approach covering all browsing-related hives and artefacts which ultimately resulted in improving the accuracy and effectiveness. Rigorous quantitative and qualitative research has been conducted by assessing the D2WFP following a scientifically sound and comprehensive process in different scenarios and the obtained results show an apparent increase in the number of artefacts recovered when adopting the D2WFP which outperforms any current industry or opensource browsing forensic tools. The second contribution of the D2WFP is the robust formulation of artefact correlation and cross-validation within the D2WFP which enables digital forensic professionals to better document and structure their analysis of host-based deep and dark web browsing artefacts.

show abstract

Section: Research Contextmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: The Landscape Of Dark and Deep Web Forensicsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

D2WFP: A Novel Protocol for Forensically Identifying, Extracting, and Analysing Deep and Dark Web Browsing Activities

Ghanem,

Mulvihill,

Ouazzane

et al. 2023

JCP

View full text Add to dashboard Cite

show abstract

Joint Alignment Networks For Few-Shot Website Fingerprinting Attack

Zhou,

Wang,

Zhu

et al. 2024

The Computer Journal

View full text Add to dashboard Cite

Website fingerprinting (WF) attacks based on deep neural networks pose a significant threat to the privacy of anonymous network users. However, training a deep WF model requires many labeled traces, which can be labor-intensive and time-consuming, and models trained on the originally collected traces cannot be directly used for the classification of newly collected traces due to the concept drift caused by the time gap in the data collection. Few-shot WF attacks are proposed for using the originally and few-shot newly collected labeled traces to facilitate anonymous trace classification. However, existing few-shot WF attacks ignore the fine-grained feature alignment to eliminate the concept drift in the model training, which fails to fully use the knowledge of labeled traces. We propose a novel few-shot WF attack called Joint Alignment Networks (JAN), which conducts fine-grained feature alignment at both semantic-level and feature-level. Specifically, JAN minimizes a distribution distance between originally and newly collected traces in the feature space for feature-level alignment, and utilizes two task-specific classifiers to detect unaligned traces and force these traces mapped within decision boundaries for semantic-level alignment. Extensive experiments on public datasets show that JAN outperforms the state-of-the-art few-shot WF methods, especially in the difficult 1-shot tasks.

show abstract

D2WFP: A Novel Protocol for Forensically Identifying, Extracting, and Analysing Deep and Dark Web Browsing Activities

Ghanem,

Mulvihill,

Ouzzane

et al. 2023

Preprint

View full text Add to dashboard Cite

The use of the un-indexed web, commonly known as the deep web and dark web, to commit or facilitate criminal activity has drastically increased over the past decade. The dark web is an infamously dangerous place where all kinds of criminal activities take place, despite advances in web forensics techniques, tools, and methodologies, few studies have formally tackled the dark and deep web forensics and the technical differences in terms of investigative techniques and artefacts identification and extraction. This research proposes a novel and comprehensive protocol to guide and assist digital forensics professionals in investigating crimes committed on or via the deep and dark web, the protocol named D2WFP establishes a new sequential approach for performing tasks and subtasks to improve the accuracy and effectiveness of current tools' output. Quantitative and qualitative research has been conducted by testing the protocol following a comprehensive and rigorous process in different scenarios and the obtained results show an apparent increase in the number of artefacts recovered when adopting D2WFP. The second contribution of D2WFP is the artefacts correlation and cross-validation which enables Digital Forensics professionals to better document and structure their analysis of host-based deep and dark web browsing artefacts.

show abstract

Dark Web Forensics: An Investigation of Tracking Dark Web Activity with Digital Forensics

Cited by 4 publications

References 13 publications

D2WFP: A Novel Protocol for Forensically Identifying, Extracting, and Analysing Deep and Dark Web Browsing Activities

D2WFP: A Novel Protocol for Forensically Identifying, Extracting, and Analysing Deep and Dark Web Browsing Activities

Joint Alignment Networks For Few-Shot Website Fingerprinting Attack

D2WFP: A Novel Protocol for Forensically Identifying, Extracting, and Analysing Deep and Dark Web Browsing Activities

Contact Info

Product

Resources

About