Perceptual image hashing based on frequency dominant neighborhood structure applied to Tor domains recognition.

Tor (The Onion Router) is one of the most famous anonymous networks in the Deep Web. It provides a wide range of legal and illegal hidden services to the user. Recognizing such illicit domains is a challenging task for Cyber Security and Law Enforcement Agencies. However, doing it manually, based only on the officers’ experience, is slow and prone to errors. Therefore, in this paper, we propose an automatic method based on perceptual hashing to recognize services on the Tor network only by means of their snapshots. Firstly, we introduce and make publicly available DUSI-2K (Darknet Usage Service Images-2K), an image dataset which contains snapshots from active Tor service domains. We also present a new, efficient, robust and discriminative image hashing method, named F-DNS, built by incorporating the Dominant Neighborhood Structure (DNS) map and the Global Neighborhood Structure (GNS) texture energy map extracted from the discrete cosine transform of the image. In order to evaluate the efficiency of our hashing method, we carry out intra- and inter- tests using images from some state-of-the-art datasets subject to various content-preserving operations. The high correlation coefficient values that our method obtains, indicates that F-DNS performs better than other state-of-the-art methods, especially in the case of rotation. Additionally, we assess F-DNS for recognizing the category of Tor domains based on their snapshots using the DUSI-2K dataset. We compare its performance with three typical image classification methods, i.e. Bag of Visual Words (BoVW) and features obtained from ResNet50 and Inception-ResNet-v2. F-DNS outperforms all of them, with an accuracy of 98.75%, against 31.39%, 82.70% and 85.19%, respectively. Fine-tuning ResNet50 and Inception-Resnet-v2 for DUSI-2K does not improve the result, attaining 37.12% and 79.15%, respectively.