Improving Tor Hidden Service Crawler Performance

The Tor anonymity network is one of the most popular and widely used tools to protect the privacy of online users. Tor provides defenses against multiple adversarial activities aiming to identify or trace the users. Traffic analysis is a very strong tool that can be used for internet surveillance. Traffic analysis attacks against Tor's anonymity network has been known as an open question in research. Moreover, the low-latency feature Tor tries to provide to its users imposes limitations in defending against traffic analysis attacks. In our study, we examine traffic analysis attacks from the perspective of the adopted adversary model and how much it fits within Tor's threat model. The purpose of this study is to evaluate how practical these attacks are on real-time Tor network.

The U.S. government engaged in unprecedented forms of mass surveillance in the twenty-first century. Users of the The Onion Router (Tor), an anonymity-granting technology, mask themselves from state surveillance and can gain access to illicit content on the Dark Web. Drawing on theory regarding “exposure” to surveillance, this study examines how two issue-attention cycles (related to the Edward Snowden state surveillance revelations and the Dark Web respectively) are associated with public interest in the Tor browser in the United States. Using data at the state-year level from 2006 to 2015, this study estimates fixed effects models, controlling for sociodemographics, the presence of journalism, tech, and political jobs, as well as multiple measures of state political ideology. The results indicate that state-years with greater popularity of Google searches related to the Snowden story had significantly higher popularity of searches for Tor. By contrast, there was no association between Dark Web search popularity and Tor search popularity. These findings are consistent with the notion that the Snowden incident increased Americans’ sense of exposure, leading to interest in anonymity-granting technology.

In the Tor anonymity network, the distribution of topology information relies on the correct behavior of five out of the nine trusted directory authority servers. This centralization is concerning since a powerful adversary might compromise these servers and conceal information about honest nodes, leading to the full de-anonymization of all Tor users. Our work aims at distributing the work of these trusted authorities, such increasing resilience against attacks on core infrastructure components of the Tor network. In particular, we leverage several emerging technologies, such as blockchains, smart contracts, and trusted execution environments to design and prototype a system called SmarTor. This system replaces the directory authorities with a smart contract and a distributed network of untrusted entities responsible for bandwidth measurements. We prototyped SmarTor using Ethereum smart contracts and Intel SGX secure hardware. In our evaluation, we show that SmarTor produces significantly more reliable and precise measurements compared to the current measurement system. Overall, our solution improves the decentralization of the Tor network, reduces trust assumptions and increases resilience against powerful adversaries like law enforcement and intelligence services.

Though the widely used Tor anonymity network is designed to enable low-latency anonymous communication, interactive communications on Tor incur latencies over 5 × greater than on the direct Internet path, and in many cases, autonomous systems (ASs) can compromise anonymity via correlations of network traffic. In this paper, we develop LASTor, a new Tor client that addresses these shortcomings in Tor with only client-side modifications. First, LASTor improves communication latencies by accounting for the inferred locations of Tor relays while choosing paths. Since the preference for shorter paths reduces the entropy of path selection, we design LASTor so that a user can choose an appropriate tradeoff between latency and anonymity. Second, we develop an efficient and accurate algorithm to identify paths on which an AS can compromise anonymity by traffic correlation. LASTor avoids such paths to improve a user's anonymity, and the low runtime of the algorithm ensures that the impact on end-to-end communication latencies is low. Our results show that, in comparison to the default Tor client, LASTor reduces median latencies by 25% while also reducing the false negative rate of not detecting a potential snooping AS from 57% to 11%.

The article is devoted to the problems of considering digital information as an object of expert research. It is proposed to amend the current criminal procedural legislation by adding part 2 of Art. 84 of the Criminal Procedure Code of Ukraine with new sources of evidence – digital, namely, to state it in the following wording: «2. Procedural sources of evidence are testimony, material evidence, digital evidence, documents, and expert opinions. The definition of digital information is formulated in the context of the investigation of criminal proceedings, namely, it is indicated that it can be understood as data presented in electronic (digital) form, containing information relevant to the case, containing traces of a criminal offence that is an instrument or means of committing it, stored on tangible media: computer, mobile devices, digital cameras, routers, etc., or intangible resources such as the Internet, databases, local networks of institutions and organizations, etc., while on the specified media may contain: files (containing text information, audio or video); a variety of software used as a «tool» for committing a crime or to hide the traces of its commission; files containing traces of forgery or falsification; databases, free access to which is prohibited by the current legislation in the field of protection of state secrets, protection of personal data; scanned copies, photocopies of restricted documents, etc. Two groups of digital information are identified, which are the object of expert research in the course of the pre-trial investigation: digital information located on a material storage medium; digital information located on the Internet or in cloud storage. Attention is drawn to the forensic computer-technical examination of digital information located in the darknet, since persons carrying out criminal activities using it use a fairly extensive data protection system to exclude the possibility of identifying the offender by law enforcement agencies: «protected» operating systems are used: Linux, Kodachi Linux, etc.; browsers are used that are not widely used by consumers, such as, for example, Tor Browser, which allows you to establish an anonymous network connection that has some protection from outside interference; access to the Internet is carried out using a VPN in order to prevent the determination of the actual location of a person and his IP address.

Background/Objective: Privacy is the vital issue when sharing of the data comes into picture. The demand and scope for privacy is increasing day-by-day as data storage techniques have emerged from standalone database to distributed database and then progressed to parallel databases. K-means and Fuzzy C-means (FCM) are the frequently used clustering algorithms for standalone database, distributed database and parallel databases. The current paper highlights Particle Swam Optimization algorithm along with Fuzzy C-means clustering algorithm technique for preserving the privacy on distributed databases. Methods/Statistics Analysis: The experimentation is performed by means of the datasets accessible in the UCI machine-learning repository. The main benefit of the suggested technique is that, this technique will assess in terms of their privacy of cluster. Therefore, the technique plans to give improved visibility for the protected data. The technique is executed in the working platform of MATLAB and the effects will be examined to show the presentation of the suggested clustering technique. Findings: The performance of the proposed clustering technique based on privacy preserving is analyzed for accuracy and Database Different Ratio (DBDR) on six UCI medical related data sets namely Hugerian dataset, Cleveland data set, Reprocessed Hugerian data sets, Long Beach V.A data, BUPA and liver disorder data. Performance improvement observed in the range of 3%-6% on each of the six data sets compared to K-means algorithm. Application/Implementation: The main benefit of the suggested technique is that technique will have to assess in terms of their privacy of cluster. Therefore, the technique plans to give improved visibility for the protected data

There is a lot of interest in Docker, an open-source application containerization breakthrough. Applications may be built, delivered, and run across a network using Docker. In contrast to past advancements, Docker has the potential to streamline labor-intensive procedures. The time and effort needed to provide and oversee services has been decreased as a result of this breakthrough. Docker offers a window of opportunity to further improve server farms' (DCs') effectiveness. Nevertheless, existing concepts and approaches are not sufficient to effectively use Docker containers for asset distribution. The outdated PC clustering techniques have been defeated by the idea of mass grouping. In this paper, we assess the Docker environment's effectiveness and examine the security implications of using containers in typical situations. To improve the flexibility and variety of use arrangement and activity in distributed computing environments, new designs and processes are being developed and taken into consideration, such as microservice engineering and Docker holders. This article presents a behavior analysis of DoS/DDoS attacks for Dockers. Without a doubt, Docker has taken the lead in the container business. It is a complete tool for transferring software packages and programs, not merely a storage system. A lightweight, quick, and adaptable substitute for hypervisor-based virtualization is the Docker holder, which allows the sharing of activity frameworks and related libraries. It is a great match for software-defined network traffic because of these qualities.

Practical Vulnerabilities of the Tor Anonymity Network

Recent events continue to expose the ability and commitment of Government Intelligence Agencies (GIAs) to conduct cross-border surveillance of the Internet. These revelations have significant consequences for anonymous communication systems like Tor. Current adversarial models do not incorporate international surveillance, meaning that realistic adversaries are much more powerful than what is assumed by prior work. In this work, we take the first steps towards quantifying the risk of surveillance posed by GIAs. We use legal and technical data to assess the hostility of each country to Internet traffic, and build a graph of the intelligence treaties between countries to identify cross-border surveillance capabilities. Based on this data, we develop metrics that quantify the ability of an adversarial GIA to conduct surveillance in any other country. We apply our risk metrics to the current state of the Tor anonymity network and discover that the majority of Tor users are at significant risk to passive deanonymization attacks by GIAs. We incorporate our metrics into alternative Tor relay selection algorithms, and show that the resulting circuits have significantly reduced surveillance risk, compared to Tor's standard relay selection algorithm.

The expected cell latency for multi-hop M/D/1 queuing networks, where users choose nodes randomly according to some distribution, is derived. It is shown that the resulting optimisation surface is convex, and thus gradient-based methods can be used to find the optimal node assignment probabilities. This is applied to a typical snapshot of the Tor anonymity network at 50% usage, and leads to a reduction in expected cell latency from 11.7 ms using the original method of assigning node selection probabilities to 1.3 ms. It is also shown that even if the usage is not known exactly, the proposed method still leads to an improvement.

Soft computing: tools for intelligent reservoir characterization (IRESC) and optimum well placement (OWP)

The crucial parameters influencing drilling operations, reservoir production behavior, and well completion are lithology and reservoir rock. This study identified optimal reservoir rocks and facies in 280 core samples from a drilled well in the Asmari reservoir of the Mansouri field in SW Iran to determine the number of hydraulic flow units. Reservoir samples were prepared, and their porosity and permeability were determined by measuring devices. The flow zone index (FZI) was calculated for each sample using MATLAB software; then, a histogram analysis was performed on the logarithmic data of the FZI, and the number of hydraulic flow units was determined based on the obtained normal distributions. Electrical facies were determined based on artificial neural network (ANN) and multi-resolution graph-based clustering (MRGC) approaches. Five electrical facies with dissimilar reservoir conditions and lithological compositions were ultimately specified. Based on described lithofacies, shale and sandstone in zones three and five demonstrated elevated reservoir quality. This study aimed to determine the Asmari reservoir’s porous medium’s flowing fluid according to the C-mean fuzzy logic method. Furthermore, the third and fourth flow units in the Asmari Formation have the best flow units with high reservoir quality and permeability due to determining the siliceous–clastic facies of the rock units and log data. Outcomes could be corresponded to the flow unit determination in further nearby wellbores without cores.

Studies of individual network users' behavior patterns may seem of little relevance to predicting the entire network's traffic. Clustering techniques, however, help bridge this apparent gap. In this paper, we analyze data collected from a deployed network and use clustering techniques to characterize patterns of individual users' behavior. A network traffic prediction approach is then developed based on user clusters. We analyze three months of continuous network log data from the E-Comm network, an operational trunked radio system. After extracting traffic data from the raw data logs, we identify user clusters by employing the AutoClass tool and the K-means algorithm. Based on the identified user clusters, we use the seasonal autoregressive integrated moving average (SARIMA) model to forecast the network traffic by aggregating the predicted traffic of each user cluster. The predicted network traffic shows good agreement with the collected traffic data.

Web usage mining improves the efficiency and personalization of Web-based services by using data mining techniques to identify patterns in user activity from Web log data. Preprocessing, pattern finding, and pattern analysis are its three primary stages. Among other methods, association rule mining is essential for identifying connections between user actions or viewed web sites. In addition to offering a thorough taxonomy of current research and commercial systems in the field, this study investigates the application of association rule mining within the larger framework of Web usage mining. This study examines user navigation behavior by analysing web server logs. Using association rule mining and clustering techniques, we identify frequent usage patterns and group similar webpages. Key findings highlight connections between webpage visits and offer insights into user behaviour over time.

Currently, there is a gap between how data is collected on the shop floor based on resources such as machines, robots, and Autonomous Guided Vehicles (AGVs) and the manufacturing orchestration software that sits above these resources and controls their interaction from the point of the creation of single products. Shop-floor resources create data streams that are saved in databases, cleaned, and then re-contextualized, i.e., to connect the data to orders, batches, and single products. New analysis prospects arise when integrating this data and analysis methods with the process-oriented analysis perspective. This paper exploits these prospects based on a real-world case: BPMN models are created for the manufacturing of two real-world products: (1) a low volume, high complexity lower-housing for a gas turbine and (2) a high volume, low complexity, small tolerance valve lifter for a gas turbine. Instead of collecting the data independently based on the participating machines, the data collection of 30+ values is modeled into the BPMN models and enacted by a workflow engine, resulting in execution logs. Conformance checks are conducted and interpreted for the scenarios and it is shown how existing classification and clustering techniques can be used to predict good and bad parts, ex-post and potentially at run-time.