Multimodal Classification of Onion Services for Proactive Cyber Threat Intelligence Using Explainable Deep Learning

Abstract

The dark web has been confronted with a significant increase in the number and variety of onion services of illegitimate and criminal intent. Anonymity, encryption, and the technical complexity of the Tor network are key challenges in detecting, disabling, and regulating such services. Instead of tracking an operational location, cyber threat intelligence can become more proactive by utilizing recent advances in Artificial Intelligence (AI) to detect and classify onion services based on the content, as well as provide an interpretation of the classification outcome. In this paper, we propose a novel multimodal classification approach based on explainable deep learning that classifies onion services based on the image and text content of each site. A Convolutional Neural Network with Gradient-weighted Class Activation Mapping (Grad-CAM) and a pre-trained word embedding with Bahdanau additive attention are the core capabilities of this approach that classify and contextualize the representative features of an onion service. We demonstrate the superior classification accuracy of this approach as well as the role of explainability in decision-making that collectively enables proactive cyber threat intelligence in the dark web.

A Systematic Literature Review on Cyber Threat Intelligence for Organizational Cybersecurity Resilience

“…The model is based on query logs from Domain Name System (DNS) servers from 2004 to 2015, and it identified 107 malicious domain names associated with botnet traffic [ 12 ]. In another study, Moraliyage et al [ 13 ] proposed using Artificial Intelligence (AI) to categorize the sites based on their content, using a new approach called explainable deep learning. The explainable deep-learning approach analyzes images and text on each site with advanced AI algorithms, such as the Convolutional Neural Network for image analysis with Gradient-weighted Class Activation Mapping (Grad-CAM) and pre-trained word embedding for text analysis.…”

“…The explainable deep-learning approach analyzes images and text on each site with advanced AI algorithms, such as the Convolutional Neural Network for image analysis with Gradient-weighted Class Activation Mapping (Grad-CAM) and pre-trained word embedding for text analysis. Combining these techniques in two learning pathways—one focused on images, and one focused on text—the method can accurately identify different types of onion services while explaining how it made those classifications based on specific features or patterns found within each site’s content [ 13 ].…”

Explainable AI for Human-Centric Ethical IoT Systems

“…Hwang and Lee [23] proposed a mechanism using XAI to visually display the sensors that are behaving abnormally when an intrusion happens to reduce the overhead of multiple checks in the event of a false alarm. Moraliyage et al [24] proposed a novel multimodal classification approach for deep learning algorithms, that enable the identification and classification of the onion services in the dark web. The anonymity of the services and the complexity of the Tor's HS protocol upon which the dark web operates makes it difficult for the cyber threat intelligence software to identify these services with criminal intent.…”

Towards an AI-Enhanced Cyber Threat Intelligence Processing Pipeline

“…Moraliyag et al [16] proposed a proactive approach to CTI by classifying onion services based on content. Onion services, also known as hidden services, are services that are hosted on the Tor network (h ps://www.torproject.org/ (accessed on 4 January 2024)).…”