# Tor Hidden Services: A Systematic Literature Review
## 5 Results and Discussion
### What Are the Most Cited Articles in the Area of HS?  
As mentioned in the methodology, the documents were obtained from three databases: Web of Science, Scopus, and Google Scholar. The latter is the search engine that gave the most results, including a large number of repeated results that had already been selected from the other two databases. Therefore, to homogenise the number of citations that each article received, Google Scholar was used as the source, and only in its absence were the other two used.  
The three most cited articles are focused on security [25, 47, 48]--more specifically, on de-anonymisation. Additionally, the third one presents an analysis in terms of HS discovery. Of the articles [25, 47, 48], the total numbers of citations are 363, 270, and 169, respectively. It is worth mentioning that the first two were published in 2006, whereas the last one, which is the least cited, was published in 2013.  
In the latter, [PERSON] et al. [25] analysed the weaknesses in hidden services that can be exploited by attackers to detect, measure, and de-anonymize HS, and described several relevant attack methods, based on traffic confirmation techniques and the fact that an attacker can easily include malicious nodes in the Tor network. They also claimed that large-scale hidden service de-anonymisation attacks are practically possible with only a moderate amount of resources. They exploited Tor vulnerabilities to collect hidden service descriptors, classify their content, and detect the most popular hidden services. In short, this is one of the most comprehensive documents about Tor and its onion services.  
Figure 6: Number of publications by year.  
Is There Any Relationship between Launching Tor Rendezvous Specification Version 3 and the Research Done on HS?  
According to the Tor Project [85], in 2008, the idea of making Tor more accessible to people with less technical knowledge was introduced. Hence, they started developing the Tor Browser, a tool beyond the Tor proxy, which from 2010 positioned Tor as an instrumental tool for protecting people's identity online and granting access to critical resources, social networks, and blocked sites. The versions of the Tor protocol released have been consistent since then and to this day.  
Since then, Tor has released several versions to improve performance, offer better resistance against fingerprinting attacks, correct vulnerabilities, and improve security features. In 2017, they presented the next generation of onion services at DEF CON 25, that is, the version 3. This new version introduces the following improvements: better security (cryptography, advanced client authorisation, better onion addresses, a smaller surface for targeted attacks) [85], less directory protocol leaking to directory services, and fewer offline keys for onion services. In this new generation, the onion addresses are 56 characters instead of 16 to prevent the malicious discovery of onion services. Version 2 is still working (although it is expected to stop working in Octuber 2021). Indeed, in the second half of 2020, Tor experienced the largest peak in number of.onion addresses to date [86]. Since then, this number has been decreasing progressively.  
Although we expect that the deployment of the new generation of hidden services promises an increase in the number of investigations, or at least new topics to cover, none of the articles we studied included issues related to this new version.