Mapping Real-World Use of the Onion Router

• In Event: Mapping Surface & Dark Web Networks

Abstract

The Onion Router (TOR) has been discussed as an anonymizing tool used for nefarious purposes. Past scholarship has focused on publicly available lists of onion URLs containing illegal content. This study is an attempt to move past these explanations and into a discussion of actual use data; a system to identify real-world TOR traffic was developed. The researcher configured and deployed a fully functioning TOR “exit” node for public use. A Wireshark instance was placed between the node and the internet to collect usage data (destination URLs, length of visit, etc.). For 6 months, the node ran and collected data. The researcher developed a custom tool to filter the URLs into human-readable form and to produce descriptive data. All URLs were coded and categorized into a variety of classifications. Findings reveal that most TOR usage is rather benign, with users spending more time on ordinary sites than on those with illegal content. Although most URLs collected were for English-language websites, there were a sizable amount for Russian and Chinese sites, which may demonstrate the utilization of TOR in countries where internet access is censored or by government. This study demonstrates that TOR is utilized by offenders and non-offenders alike.

Author

• Adam Kavon Ghazi-Tehrani, Indiana University