# Tor Hidden Services: A Systematic Literature Review
## 5 Results and Discussion
### What Are the Main Research Areas and the Main Findings Regarding HS?
#### 5.1.1 Security  
As shown in Table 2, security is the main field of research regarding HS. Within this field, we can classify the papers into two categories. On the one hand, some articles cover specific attacks for denial-of-service (DoS) or de-anonymizing HS, and on the other hand, others are focused on preventing any of these attacks. In Table 3 we classify the papers covering security into these categories. As we can see, most of the papers are focused on attacks. We can also point out that there are also papers that cover both possible attacks and mechanisms to prevent them as in [47, 51, 53] (see Figure 4). Next, we analyse the categories shown in Table 3.  
Attacks to HSAs mentioned, there are two main attacks on HS: de-anonymisation attacks and DoS attacks. First, we analyse de-anonymisation attacks. [PERSON] and [PERSON] [47] were the first to document an attack on HS. They studied the first version of the Tor hidden service protocol and claimed that one of the main vulnerabilities in Tor is the selection of the first and last nodes in the communication path. Figure 4: Relationships between papers and areas. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Focus of the Research** & **Research Papers** & **No. of Papers** \\ \hline Attacks to HS & [25, 26, 47, 48, 50, 52, 53, 55, 56, 57, 59, 60, 64, 65, 66, 67, 68, 69, 70, 72] & 20 \\ \hline Prevention against attacks & [47, 49, 51, 53, 54, 58, 61, 62, 63] & 9 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Classification of the papers in the security field. Generally speaking, if an opponent can see the edges of a Tor circuit, then he can confirm who is communicating. For this attack to be successful, the attacker has to control at least one node within the network, and after multiple connection attempts, he or one of these malicious onion routers (ORs) will be chosen as the first node in the rendezvous circuit established by the hidden service. From there, the attacker sends specific traffic patterns from the client to determine if one of its nodes was finally chosen as part of the circuit of interest. Once the attacker has identified that his node is the first incoming OR of the server, as shown in Figure 5, the identity of the server is revealed. Using the same idea of controlling the server-side input node, [PERSON] et al. [52] used the web browser to access the target hidden service and generate specific traffic on the circuit. If the controlled OR detects the traffic pattern, the opponent can compare and correlate the time between the web accesses and the traffic generated on the compromised router, and detect the actual IP of the server through the inbound node. Other attacks like this one based on the correlation of the traffic increase using the entry node were also described by [PERSON] et al. [56], [PERSON] [57], and [PERSON] et al. [64, 65]. [PERSON] and [PERSON] [66] presented the same idea of using an entry node and traffic flow, but in this case, to discover the identity of the client who wants to communicate with the server, assuming that this HS is malicious. Another paper showing an attack based on the fact that it is possible to control the entry node is [71], which mentions that Tor has a TCP/Tor congestion management mechanism. This mechanism causes a data source to stop sending messages until it receives an acknowledgement of the receipt of a previous message. The researchers managed to exploit this to create an attack, by embedding a watermark on the client-side and a flow detector module on the inbound node they controlled, which monitored and analysed all the traffic passing through in order to detect the hidden server's IP. [PERSON] [55] and [PERSON] [60] demonstrated that an HS could be identified using fingerprint tracking, created from requests to the application server, disguised as a common user pattern sent by the client. In this attack, they assumed that the client could listen to the server's communication channel in order to try to detect the inserted fingerprint.