# Tor Hidden Services: A Systematic Literature Review
## 5 Results and Discussion
### What Are the Main Research Areas and the Main Findings Regarding HS?
#### 5.1.1 Security
More specifically, if the first responsible directory is controlled, the attacker can monopolise or block all incoming HS nodes before customers can contact them. Prevention against Attacks  
Other related THS works have presented preventive measures to counteract the previously exposed vulnerabilities. In particular, [PERSON] and [PERSON] [49], after exposing an attack using the entry nodes, showed that it could be counteracted by using what they call _\"Valet Services\"_ as an extension of the concept of hidden services. The basic idea is to add an additional layer of protection for the entry points, hiding them from users. These valet nodes are now known within the Tor network as guard nodes. Other ideas for preventing traffic analysis attacks were put forward by [PERSON] and [PERSON] [54], and by [PERSON] et al. [61]. Each article proposed a different routing architecture. The first one proposed that the hidden service should also be part of the routers and that a closed circuit should be formed in the form of a ring, where data packets travel along the circuit together with dummy packets or filler packets in both directions of the circuit. In this case, all the ORs in the ring see the traffic, but only the hidden server can understand it because only the HS can decode all the encryption layers. The second article presented a cell scheme based on multiple routes that exploits flow mixing and merging to distort or destroy the traffic patterns inserted by an attacker. [PERSON] [58] conducted a study on Tor's challenges to protect hidden services from botnet abuse, which can lead to poor network performance due to increased load on nodes. Solutions to this problem include reusing failed partial circuits and isolating circuits for hidden services. For the latter case, the author stated that if a mechanism that allows ORs to recognise that a cell carries hidden service traffic is introduced, a means of protecting the rest of the system from the effects of this traffic can be provided by scheduling priority or simple isolation. Another interesting direction is the creation of _\"honey onions\"_ (honeypots + onion services) [62] to identify malicious directories. These Honions, as they are called in the literature, are HS whose links (.onion) are not public anywhere, which means that only the service administrators knows= about then. Therefore, when there is a possible access attempt, it is assumed to be a malicious HSDir connection attempt. On the other hand, works such as [51, 53] have approached the subject from a forensic perspective. The researchers exposed the creation of a persistent fingerprint through a flow of requests that can be recorded on a computer through a hidden service, so that, at a later time, it can be retrieved and used as evidence that a physical machine hosted particular content even after this content has been removed. This approach does not actually locate the anonymous server, but authorities can use it as almost foolproof evidence of a criminal provider's guilt. Finally, as for MITM attacks, [PERSON] and [PERSON] [69] have defined a mechanism based on comparing descriptors to detect them.