Threats from the Dark: A Review over Dark Web Investigation Research for Cyber Threat Intelligence

Abstract

From proactive detection of cyberattacks to the identification of key actors, analyzing contents of the Dark Web plays a significant role in deterring cybercrimes and understanding criminal minds. Researching in the Dark Web proved to be an essential step in fighting cybercrime, whether with a standalone investigation of the Dark Web solely or an integrated one that includes contents from the Surface Web and the Deep Web. In this review, we probe recent studies in the field of analyzing Dark Web content for Cyber Threat Intelligence (CTI), introducing a comprehensive analysis of their techniques, methods, tools, approaches, and results, and discussing their possible limitations. In this review, we demonstrate the significance of studying the contents of different platforms on the Dark Web, leading new researchers through state-of-the-art methodologies. Furthermore, we discuss the technical challenges, ethical considerations, and future directions in the domain.

A Systematic Literature Review on Cyber Threat Intelligence for Organizational Cybersecurity Resilience

“…Basheer and Alkhatib [ 41 ] wrote a review article to outline the importance of testing and checking the dark web for CTI to prevent crimes and gain insight into criminal activities. The review includes recent research in the area, examining techniques, tools, methods, approaches, and outcomes.…”

“…The review includes recent research in the area, examining techniques, tools, methods, approaches, and outcomes. It also addresses technical hurdles, ethical considerations, and potential future developments [ 41 ].…”

Conceptualizing Discussions on the Dark Web: An Empirical Topic Modeling Approach

“…Such software provides users anonymity and trafc encryption, encouraging illicit and criminal activities to take place widely on the Dark Web without the fear of revealing identities or geographic locations and increasing their ability to avoid detection and arrest [3]. Such malicious activities include drug trade, stolen and counterfeit credit cards, fraud, terrorism and extremism, propaganda dissemination, hacking tools and tutorials, child pornography, weapon trade, and many others [1,3,4]. It is estimated that activities of such types form about 80% of the Dark Web [5].…”

Darkweb research: Past, present, and future trends and mapping to sustainable development goals

“…The Darkweb or Darknet is an intrinsic part of the deep web but represents the darker and regressive side of the world wide web. Key characteristics of the Darkweb include the inability to search or list them through legal platforms, passwords to gain entry when accessible, and hidden identities of users, network traffic, IP addresses, and data exchanged through them [ 1 ]. While Darkweb was originally built for military communication and advocating freedom of speech, it has also provided technology enablement and power to adversaries to masquerade heinous activities.…”

“…Due to the extensive convoluted procedures, enforcing regulations or shutting down the gateways to Darkweb bridges or relays is nearly impossible. That said, most research has been focussed on developing tools and techniques for detecting criminal and terror provocative activities [ 4 ] and cyber threat intelligence [ 1 ] that draw valuable insights from various sources on the surface web and Darkweb. The exploratory data analysis is a good example of early work in scrawling and analyzing Darkweb marketplaces to answer basic linchpins such as what, when, which, and how aspects of crime enablers [ 5 ].…”