Threat Intelligence Analysis For Tor Network Services

As events such as Silk Road,the world’s largest illegal trading platform,was exposed by the FBI,and the information of 267 million Facebook users was leaked on the dark web,the dark web space under the surface of the clear web space has gradually appeared frequently in the general public.in the topic.The dark web space built with the onion routing Tor network protocol as the core not only provides reliable network anonymity means for network users,but also provides a natural living soil for the cybercriminal business.As governments around the world tighten their governance over the surface network,Internet crime businesses are rapidly shifting to communities in the dark web space,and the hard-totrace highly anonymous dark web communities behind dark web businesses are also becoming the current network.The number one threat to order.In contrast to this,on the one hand,the traditional Tor network threat intelligence analysis based on the darknet node layer and the darknet service layer is the main oriented,the cost is huge,the output efficiency is not high,it is located in the darknet node layer and the service layer.Cyber threat intelligence also lacks the interpretability of dark web business.On the other hand,the analysis and aggregation methods suitable for user group portraits on the brightnet cannot be well implemented in the darknet business-level community that lacks user-specific labels such as IP address or gender,and has strong anonymity.Therefore,a new Tor network threat intelligence analysis solution that fits the characteristics of the dark web,is low-cost,has strong interpretability is proposed to further achieve the goal of de-anonymizing dark web business information.Community,governance of cyberspace crime and maintenance of cyberspace order have important theoretical significance and practical value.This research will define the difficulties and challenges faced when traditional methods are applied to the darknet business layer for Tor network business threat intelligence analysis on the basis of a large number of previous researches on darknet threat intelligence.In response to these defined problems,this research will firstly propose an analysis scheme to identify and aggregate darknet communities by introducing natural language features.Based on the boundary information between the Internet and the clear web space,a low-threshold,sustainable and efficient dark web community business information de-anonymization scheme is proposed.Finally,based on the Tor network business threat intelligence analysis scheme proposed in this research,this research will further design,implement and verify the systematic implementation of the scheme.A lightweight ensemble tree multiclassification algorithm for short text scenarios in the darknet community,further implements and tests a threat intelligence that can obtain,analyze,then correlate Tor network business,can produce highly interpretable darknet business information to de-anonymize Finally,through the experimental results and actual output of the system,the theoretical feasibility and practical application value of the Tor network business threat intelligence analysis scheme proposed in this study are further verified.