Publications
2020
1.
Biswas, Rubel; González-Castro, Víctor; Fidalgo, Eduardo; Alegre, Enrique
Perceptual image hashing based on frequency dominant neighborhood structure applied to Tor domains recognition Artículo de revista
En: Neurocomputing, vol. 383, pp. 24–38, 2020, (Publisher: Elsevier).
Resumen | Enlaces | BibTeX | Etiquetas: Cybersecurity, Deep Web, perceptual hashing, TOR
@article{biswas_perceptual_2020,
title = {Perceptual image hashing based on frequency dominant neighborhood structure applied to Tor domains recognition},
author = {Rubel Biswas and Víctor González-Castro and Eduardo Fidalgo and Enrique Alegre},
url = {https://www.sciencedirect.com/science/article/pii/S0925231219316674},
year = {2020},
date = {2020-01-01},
journal = {Neurocomputing},
volume = {383},
pages = {24–38},
abstract = {This paper proposes an automatic method to recognize illicit domains on the Tor network using perceptual hashing through domain snapshots. The method introduces DUSI-2K, a dataset of Tor service domain snapshots, and F-DNS, a new hashing technique based on Dominant Neighborhood Structure (DNS) and Global Neighborhood Structure (GNS). F-DNS outperforms other state-of-the-art methods, achieving an accuracy of 98.75% in recognizing Tor domains, significantly surpassing methods like ResNet50 and Inception-ResNet-v2. Fine-tuning these models does not improve results, demonstrating the effectiveness of F-DNS for Tor domain classification.},
note = {Publisher: Elsevier},
keywords = {Cybersecurity, Deep Web, perceptual hashing, TOR},
pubstate = {published},
tppubtype = {article}
}
This paper proposes an automatic method to recognize illicit domains on the Tor network using perceptual hashing through domain snapshots. The method introduces DUSI-2K, a dataset of Tor service domain snapshots, and F-DNS, a new hashing technique based on Dominant Neighborhood Structure (DNS) and Global Neighborhood Structure (GNS). F-DNS outperforms other state-of-the-art methods, achieving an accuracy of 98.75% in recognizing Tor domains, significantly surpassing methods like ResNet50 and Inception-ResNet-v2. Fine-tuning these models does not improve results, demonstrating the effectiveness of F-DNS for Tor domain classification.
2.
Biswas, Rubel; Carofilis-Vasco, Andrés; Fidalgo, Eduardo; Jáñez-Martino, Francisco; Blanco-Medina, Pablo
Perceptual Hashing applied to Tor domains recognition Artículo de revista
En: arXiv preprint arXiv:2005.10090, 2020.
Resumen | Enlaces | BibTeX | Etiquetas: Cybersecurity, DCT, Deep Web, Image classification, TOR
@article{biswas_perceptual_2020-1,
title = {Perceptual Hashing applied to Tor domains recognition},
author = {Rubel Biswas and Andrés Carofilis-Vasco and Eduardo Fidalgo and Francisco Jáñez-Martino and Pablo Blanco-Medina},
url = {https://arxiv.org/abs/2005.10090},
year = {2020},
date = {2020-01-01},
urldate = {2020-01-01},
journal = {arXiv preprint arXiv:2005.10090},
abstract = {This paper introduces Frequency-Dominant Neighborhood Structure (F-DNS), a perceptual hashing method for automatically classifying Tor domains by their screenshots. F-DNS outperforms other methods, achieving better correlation coefficients, especially for rotated images. The method was tested on the Darknet Usage Service Images-2K (DUSI-2K) dataset and achieved an accuracy of 98.75%, surpassing other classification and hashing techniques.},
keywords = {Cybersecurity, DCT, Deep Web, Image classification, TOR},
pubstate = {published},
tppubtype = {article}
}
This paper introduces Frequency-Dominant Neighborhood Structure (F-DNS), a perceptual hashing method for automatically classifying Tor domains by their screenshots. F-DNS outperforms other methods, achieving better correlation coefficients, especially for rotated images. The method was tested on the Darknet Usage Service Images-2K (DUSI-2K) dataset and achieved an accuracy of 98.75%, surpassing other classification and hashing techniques.
2019
3.
Al-Nabki, Wesam; Fidalgo, Eduardo; Alegre, Enrique; Chaves, Deisy
Content-Based Features to Rank Influential Hidden Services of the Tor Darknet Artículo de revista
En: arXiv e-prints, pp. arXiv–1910, 2019.
Resumen | Enlaces | BibTeX | Etiquetas: Darknet, Feature extraction, Hidden Services, Influence Detection, Learning-to-Rank, TOR
@article{al-nabki_content-based_2019,
title = {Content-Based Features to Rank Influential Hidden Services of the Tor Darknet},
author = {Wesam Al-Nabki and Eduardo Fidalgo and Enrique Alegre and Deisy Chaves},
url = {https://arxiv.org/abs/1910.02332},
year = {2019},
date = {2019-01-01},
journal = {arXiv e-prints},
pages = {arXiv–1910},
abstract = {This paper introduces a content-based ranking framework to identify the most influential onion domains on the Tor Darknet. It models domains using 40 features from five sources (text, HTML, named entities, network topology, and visual content) and applies a Learning-to-Rank (LtR) approach for ranking. A case study on drug-related domains shows that (1) the listwise LtR method achieves an NDCG of 0.95 for the top-10, (2) the framework outperforms link-based ranking techniques, and (3) textual features (text, NER, HTML) offer the best balance of efficiency and accuracy. This system could aid law enforcement in detecting suspicious domains.},
keywords = {Darknet, Feature extraction, Hidden Services, Influence Detection, Learning-to-Rank, TOR},
pubstate = {published},
tppubtype = {article}
}
This paper introduces a content-based ranking framework to identify the most influential onion domains on the Tor Darknet. It models domains using 40 features from five sources (text, HTML, named entities, network topology, and visual content) and applies a Learning-to-Rank (LtR) approach for ranking. A case study on drug-related domains shows that (1) the listwise LtR method achieves an NDCG of 0.95 for the top-10, (2) the framework outperforms link-based ranking techniques, and (3) textual features (text, NER, HTML) offer the best balance of efficiency and accuracy. This system could aid law enforcement in detecting suspicious domains.
2018
4.
Matilla, David; González-Castro, Víctor; Fernández-Robles, Laura; Fidalgo, Eduardo; Al-Nabki, Wesam
Color SIFT descriptors to categorize illegal activities in images of onion domains Artículo de revista
En: Actas de las XXXIX Jornadas de Automática, Badajoz, 5-7 de Septiembre de 2018, 2018, (Publisher: Universidad de Extremadura).
Resumen | Enlaces | BibTeX | Etiquetas: Dark Web, Image classification, TOR
@article{matilla_color_2018,
title = {Color SIFT descriptors to categorize illegal activities in images of onion domains},
author = {David Matilla and Víctor González-Castro and Laura Fernández-Robles and Eduardo Fidalgo and Wesam Al-Nabki},
url = {https://scholar.google.es/citations?view_op=view_citation&hl=en&user=4jZgNVkAAAAJ&cstart=20&pagesize=80&sortby=title&citation_for_view=4jZgNVkAAAAJ:RHpTSmoSYBkC},
year = {2018},
date = {2018-01-01},
urldate = {2018-01-01},
journal = {Actas de las XXXIX Jornadas de Automática, Badajoz, 5-7 de Septiembre de 2018},
abstract = {This paper explores identifying illegal domains on the Tor darknet based on their visual content. After crawling 500 hidden services and categorizing their images into five illegal categories, a classifier was trained using the Bag of Visual Words (BoVW) model with SIFT descriptors. Since SIFT only works with grayscale images, color-SIFT variants (HSV-SIFT, RGB-SIFT) were tested. The results show that color-SIFT descriptors, particularly HSV-SIFT, outperform traditional SIFT, achieving an accuracy of 59.44%, compared to SIFT's 57.52%.},
note = {Publisher: Universidad de Extremadura},
keywords = {Dark Web, Image classification, TOR},
pubstate = {published},
tppubtype = {article}
}
This paper explores identifying illegal domains on the Tor darknet based on their visual content. After crawling 500 hidden services and categorizing their images into five illegal categories, a classifier was trained using the Bag of Visual Words (BoVW) model with SIFT descriptors. Since SIFT only works with grayscale images, color-SIFT variants (HSV-SIFT, RGB-SIFT) were tested. The results show that color-SIFT descriptors, particularly HSV-SIFT, outperform traditional SIFT, achieving an accuracy of 59.44%, compared to SIFT's 57.52%.
5.
Fidalgo, Eduardo; Alegre, Enrique; González-Castro, Victor; Fernández-Robles, Laura
Illegal activity categorisation in DarkNet based on image classification using CREIC method Artículo de revista
En: International Joint Conference SOCO’17-CISIS’17-ICEUTE’17 León, Spain, September 6–8, 2017, Proceeding 12, pp. 600–609, 2018, (Publisher: Springer International Publishing).
Resumen | Enlaces | BibTeX | Etiquetas: Bag of Visual Words, Edge-SIFT descriptors, Image classification, support vector machine, TOR
@article{fidalgo_illegal_2018,
title = {Illegal activity categorisation in DarkNet based on image classification using CREIC method},
author = {Eduardo Fidalgo and Enrique Alegre and Victor González-Castro and Laura Fernández-Robles},
url = {https://link.springer.com/chapter/10.1007/978-3-319-67180-2_58},
year = {2018},
date = {2018-01-01},
journal = {International Joint Conference SOCO’17-CISIS’17-ICEUTE’17 León, Spain, September 6–8, 2017, Proceeding 12},
pages = {600–609},
abstract = {This paper introduces TOIC (TOr Image Categories), a dataset of illegal images from the TOR network, and presents a method to classify them using a combination of Edge-SIFT and dense SIFT descriptors. These features are extracted from edge images created with the Compass Operator. The method employs a Bag of Visual Words model that fuses these descriptors early in the process to effectively detect and categorize illegal content. By selecting the optimal radius before calculating Edge-SIFT, the approach improves classification performance, achieving an accuracy of 92.49% on the TOIC dataset, and showing increased accuracy in tests on both TOIC and the Butterflies dataset. The method offers an efficient tool for identifying illegal content in the TOR network.},
note = {Publisher: Springer International Publishing},
keywords = {Bag of Visual Words, Edge-SIFT descriptors, Image classification, support vector machine, TOR},
pubstate = {published},
tppubtype = {article}
}
This paper introduces TOIC (TOr Image Categories), a dataset of illegal images from the TOR network, and presents a method to classify them using a combination of Edge-SIFT and dense SIFT descriptors. These features are extracted from edge images created with the Compass Operator. The method employs a Bag of Visual Words model that fuses these descriptors early in the process to effectively detect and categorize illegal content. By selecting the optimal radius before calculating Edge-SIFT, the approach improves classification performance, achieving an accuracy of 92.49% on the TOIC dataset, and showing increased accuracy in tests on both TOIC and the Butterflies dataset. The method offers an efficient tool for identifying illegal content in the TOR network.
2017
6.
Biswas, Rubel; Fidalgo, Eduardo; Alegre, Enrique
Recognition of service domains on TOR dark net using perceptual hashing and image classification techniques Artículo de revista
En: 8th International Conference on Imaging for Crime Detection and Prevention (ICDP 2017), pp. 7–12, 2017, (Publisher: IET).
Resumen | Enlaces | BibTeX | Etiquetas: Darknet Detection, Image classification, perceptual hashing, TOR
@article{biswas_recognition_2017,
title = {Recognition of service domains on TOR dark net using perceptual hashing and image classification techniques},
author = {Rubel Biswas and Eduardo Fidalgo and Enrique Alegre},
url = {https://ieeexplore.ieee.org/abstract/document/8372164},
year = {2017},
date = {2017-01-01},
journal = {8th International Conference on Imaging for Crime Detection and Prevention (ICDP 2017)},
pages = {7–12},
abstract = {This paper presents a framework for identifying services on the TOR network, leveraging image content to categorize various activities such as file-sharing, ransomware, and counterfeit goods. The authors introduce the DUSI (Darknet Usage Service Images) dataset, which includes snapshots from active TOR domains across six service categories. Two pipelines were evaluated: one using Perceptual Hashing and another using Bag of Visual Words (BoVW) with SVM classifiers. The Perceptual Hashing approach achieved the highest accuracy of 99.38%, making it the recommended method for detecting TOR services based on image snapshots.},
note = {Publisher: IET},
keywords = {Darknet Detection, Image classification, perceptual hashing, TOR},
pubstate = {published},
tppubtype = {article}
}
This paper presents a framework for identifying services on the TOR network, leveraging image content to categorize various activities such as file-sharing, ransomware, and counterfeit goods. The authors introduce the DUSI (Darknet Usage Service Images) dataset, which includes snapshots from active TOR domains across six service categories. Two pipelines were evaluated: one using Perceptual Hashing and another using Bag of Visual Words (BoVW) with SVM classifiers. The Perceptual Hashing approach achieved the highest accuracy of 99.38%, making it the recommended method for detecting TOR services based on image snapshots.
7.
Al-Nabki, Wesam; Fidalgo, Eduardo; Alegre, Enrique; González-Castro, Víctor
Detecting emerging products in tor network based on k-shell graph decomposition Artículo de revista
En: 2017.
Resumen | Enlaces | BibTeX | Etiquetas: Ciberseguridad, Darknet, K-shell, Minería de Datos, Teoría de Grafos, TOR
@article{al_nabki_detecting_2017,
title = {Detecting emerging products in tor network based on k-shell graph decomposition},
author = {Wesam Al-Nabki and Eduardo Fidalgo and Enrique Alegre and Víctor González-Castro},
url = {https://buleria.unileon.es/handle/10612/10718},
year = {2017},
date = {2017-01-01},
urldate = {2017-01-01},
abstract = {Este documento presenta un marco semiautomático para identificar productos populares y emergentes en la Darknet, utilizando un gráfico de correlaciones de productos (PCG) y el algoritmo k-Shell. Detectó MDMA y éxtasis como las drogas más relevantes, validando los resultados con informes internacionales. Esta herramienta ayuda a extraer información en mercados ilegales.},
keywords = {Ciberseguridad, Darknet, K-shell, Minería de Datos, Teoría de Grafos, TOR},
pubstate = {published},
tppubtype = {article}
}
Este documento presenta un marco semiautomático para identificar productos populares y emergentes en la Darknet, utilizando un gráfico de correlaciones de productos (PCG) y el algoritmo k-Shell. Detectó MDMA y éxtasis como las drogas más relevantes, validando los resultados con informes internacionales. Esta herramienta ayuda a extraer información en mercados ilegales.