The onion router (Tor) is one of the networks that form the Dark Web. It is also one of the most popular markets for drugs trading: far from the authorities’ monitoring tools, several deals worth millions of dollars for all kinds of illegal drugs such as Cocaine, Marijuana or Hashish, are held daily. In such an active and dynamic market, the status of the products changes over time. Unfortunately, the records of the markets’ transactions are inaccessible, which makes us lose valuable information about the offered products, such as guessing the most popular drugs, the emerging or the diminishing ones, or even the possible relations between the products. This information would help the Law Enforcement Agencies (LEAs) in estimating the trends in drugs markets. Also, the association rules between the products in the Tor domains can inform about how the products are related to each other. For example, we can conclude which products are offered tightly with Cocaine. Hereafter, this bunch of information can provide the LEAs with insights about the status of the Dark Web markets.
However, the main challenge is to obtain this information without having access to the transactions’ records. A conventional control process such as manual inspection of Tor domains represents a significant amount of time and effort, as well as the need for having specific knowledge about the subject being monitored. Therefore, we have proposed an automatic system that can figure out the emerging drugs products and the association rules between them.
Initially, the proposed system needs to be fed with a list of drugs names, which can be collected from websites like Talktofrank or Drugabuse. Then, it looks for these drugs names automatically in the text of Tor domains and uses the retrieved information to construct a graph of products where each node represents a product and the occurrence of two products is reflected by an edge between the two corresponding nodes. In addition, this graph represents the frequency of the product in the market and how frequently two products are related: the more popular a product is, the bigger the size it has, and the wider the edge is, the more frequent is the relationship between those two products. After that, we apply an algorithm, called K-Shell, that divides the products’ graph into levels according to the connectivity between the products: The products which are at the deepest level with small frequency refers to the emerging products, while the one in the same level but with high frequency refers to the popular drugs.
In conclusion, the proposed system can deliver insights about the emerging and popular drugs in the Dark Web markets without having transactions records.