The freedom of the Deep Web offers a safe place where people can express themselves anonymously but they also can conduct illegal activities . In this paper , we present and make publicly available 1 a new dataset for Darknet active domains , which we call it " Darknet Usage Text Addresses " ( DUTA ) . We built DUTA by sampling the Tor network during two months and manually labeled each address into 26 classes . Using DUTA , we conducted a comparison between two well-known text representation techniques crossed by three different supervised classifiers to categorize the Tor hidden services . We also fixed the pipeline elements and identified the aspects that have a critical influence on the classification results . We found that the combination of TF-IDF words representation with Logistic Regression classifier achieves 96.6 % of 10 folds cross-validation accuracy and a macro F1 score of 93.7 % when classifying a subset of illegal activities from DUTA . The good performance of the classifier might support potential tools to help the authorities in the detection of these activities . If we think about the web as an ocean of data , the Surface Web is no more than the slight waves that float on the top . While in the depth , there is a lot of sunken information that is not reached by the traditional search engines . The web can be divided into Surface Web and Deep Web . The Surface Web is the portion of the web that can be crawled and 1 The dataset is available upon request to the first author ( email ) . indexed by the standard search engines , such as Google or Bing . However , despite their existence , there is still an enormous part of the web remained without indexing due to its vast size and the lack of hyperlinks , i.e. not referenced by the other web pages . This part , that can not be found using a search engine , is known as Deep Web ( Noor et al . , 2011 ; Boswell , 2016 ) . Additionally , the content might be locked and requires human interaction to access e.g. to solve a CAPTCHA or to enter a log-in credential to access . This type of web pages is referred to as " database-driven " websites . Moreover , the traditional search engines do not examine the underneath layers of the web , and consequently , do not reach the Deep Web . The Darknet , which is also known as Dark Web , is a subset of the Deep Web . It is not only not indexed and isolated , but also requires a specific software or a dedicated proxy server to access it . The Darknet works over a virtual sub-network of the World Wide Web ( WWW ) that provides an additional layer of anonymity for the network users . The most popular ones are " The Onion Router"2 also known as Tor network , " Invisible Internet Project " I2P3 , and Freenet4 . The community of Tor refers to Darknet websites as " Hidden Services " ( HS ) which can be accessed via a special browser called Tor Browser5 . A study by Bergman et al . ( 2001 ) has stated astonishing statistics about the Deep Web . For example , only on Deep Web there are more than 550 billion individual documents comparing to only 1 billion on Surface Web . Furthermore , in the study of Rudesill et al . ( 2015 ) they emphasized on the immensity of the Deep Web which was estimated to be 400 to 500 times wider than the Surface Web . The concepts of Darknet and Deep Net have ex-isted since the establishment of World Wide Web ( WWW ) , but what make it very popular in the recent years is when the FBI had arrested Dread Pirate Roberts , the owner of Silk Road black market , in October 2013 . The FBI has estimated the sales on Silk Road to be 1.2 Billion dollars by July 2013 . The trading network covered among 150,000 anonymous customers and approximately 4,000 vendors ( Rudesill et al . , 2015 ) . The cryptocurrency ( Nakamoto , 2008 ) is a hot topic in the field of Darknet since it anonymizes the financial transactions and hides the trading parties identities ( Ron and Shamir , 2014 ) . The Darknet is often associated with illegal activities . In a study carried out by Intelliagg group ( 2015 ) over 1 K samples of hidden services , they claimed that 68 % of Darknet contents would be illegal . Moore et at . ( 2016 ) showed , after analyzing 5 K onion domains , that the most common usages for Tor HS are criminal and illegal activities , such as drugs , weapons and all kind of pornography . It is worth to mention about dramatic increase in the proliferation of Darknet domains which doubled their size from 30 K to 60 K between August 2015 and 2016 ( Figure 1 ) . However , the publicly reachable domains are no more than 6 K to 7 K due to the ambiguity nature of the Darknet ( Ciancaglini et al . , 2016 ) . Motivated by the critical buried contents on the Darknet and its high abuse , we focused our research in designing and building a system that classifies the illegitimate practices on Darknet . In this paper , we present the first publicly available dataset called " Darknet Usage Text Addresses " ( DUTA ) that is extracted from the Tor HS Darknet . DUTA contains 26 categories that cover all the legal and the illegal activities monitored on Darknet during our sampling period . Our objective is to create a precise categorization of the Darknet via classifying the textual content of the HS . In order to achieve our target , we designed and compared different combinations of some of the most wellknown text classification techniques by identifying the key stages that have a high influence on the method performance . We set a baseline methodology by fixing the elements of text classification pipeline which allows the scientific community to compare their future research with this baseline under the defined pipeline . The fixed methodology we propose might represent a significant contribution into a tool for the authorities who monitor the Darknet abuse . The rest of the paper is organized as follows : Section 2 presents the related work . Next , Section 3 explains the proposed dataset DUTA and its characteristics . After that , Section 4 describes the set of the designed classification pipelines . Then , in Section 5 we discuss the experiments performed and the results . In Section 6 we describe the technical implementation details and how we employed the successful classifier in an application . Finally , in Section 7 we present our conclusions with a pointing to our future work . In this paper , we have categorized illegal activities of Tor HS by using two text representation methods , TF-IDF and BOW , combined with three classifiers , SVM , LR , and NB . To support the classification pipelines , we built the dataset DUTA , We found that the combination of the TF-IDF text representation with the Logistic Regression classifier can achieve 96.6 % accuracy over 10 folds of cross-validation and 93.7 % macro F1 score . We noticed that our classifier suffers from overfitting due to the difficulty of reaching more samples of onion hidden services for some classes like counterfeiting personal identification or illegal drugs . However , our results are encouraging , and yet there is still a wide margin for future improvements . We are looking forward to enlarging the dataset by digging deeper into the Darknet by adding more HS sources , even from I2P and Freenet , and exploring ports other than the HTTP port . Moreover , we plan to get the benefit of the HTML tags and the hyperlinks by weighting some tags or parsing the hyperlinks text . Also , during the manual labeling of the dataset , we realized that a wide portion of the hidden services advertise their illegal products graphically , i.e. the service owner uses the images instead of the text . Therefore , our aim is to build an image classifier to work in parallel with the text classification . The high accuracy we have obtained in this work might represent an opportunity to insert our research into a tool that supports the authorities in monitoring the Darknet .

Challenge: Darknet which is a sub-network of the World Wide Web with an additional layer of anonymity, is often associated with illegal activities.
Approach: They present a dataset of samples of the Tor network over two months manually labelled into 26 classes and evaluate existing text classification methods.
Outcome: They find that the Logistic Regression classifier with TF-IDF representations achieves 96.6% accuracy however it also suffers from overtting for some classes.