{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,4]],"date-time":"2026-04-04T04:56:10Z","timestamp":1775278570579,"version":"3.50.1"},"reference-count":41,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2023,8,22]],"date-time":"2023-08-22T00:00:00Z","timestamp":1692662400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2023,8,22]],"date-time":"2023-08-22T00:00:00Z","timestamp":1692662400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"DOI":"10.13039\/501100010418","name":"Institute for Information and Communications Technology Promotion","doi-asserted-by":"publisher","award":["2022-0-00281"],"award-info":[{"award-number":["2022-0-00281"]}],"id":[{"id":"10.13039\/501100010418","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Inf. Secur."],"published-print":{"date-parts":[[2024,2]]},"DOI":"10.1007\/s10207-023-00745-4","type":"journal-article","created":{"date-parts":[[2023,8,22]],"date-time":"2023-08-22T17:02:47Z","timestamp":1692723767000},"page":"331-346","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":20,"title":["Forensic investigation of the dark web on the Tor network: pathway toward the surface web"],"prefix":"10.1007","volume":"23","author":[{"given":"Philgeun","family":"Jin","sequence":"first","affiliation":[]},{"given":"Namjun","family":"Kim","sequence":"additional","affiliation":[]},{"given":"Sangjin","family":"Lee","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2997-2335","authenticated-orcid":false,"given":"Doowon","family":"Jeong","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2023,8,22]]},"reference":[{"issue":"8","key":"745_CR1","doi-asserted-by":"publisher","first-page":"2824","DOI":"10.1177\/1461444817733134","volume":"20","author":"E Jardine","year":"2018","unstructured":"Jardine, E.: Privacy, censorship, data breaches and internet freedom: the drivers of support and opposition to dark web technologies. New Media Soc. 20(8), 2824 (2018)","journal-title":"New Media Soc."},{"key":"745_CR2","unstructured":"Finklea, K.M.: Dark web, Congressional Research Service. pp. 1\u201319 (2017). https:\/\/fas.org\/sgp\/crs\/misc\/R44101.pdf"},{"key":"745_CR3","unstructured":"\u00c7al\u0131\u015fkan, E., Min\u00e1rik, T., Osula, A.M.: Technical and legal overview of the tor anonymity network. NATO Cooperative Cyber Defence Centre of Excellence, Tallinn, Estonia (2015)"},{"key":"745_CR4","unstructured":"Soska, K., Christin, N.: Measuring the longitudinal evolution of the online anonymous marketplace ecosystem, 24th USENIX Security Symposium (USENIX Security 15) pp. 33\u201348 (2015)"},{"key":"745_CR5","unstructured":"DiPiero, C.: Deciphering cryptocurrency: shining a light on the deep dark web. U. Ill. L. Rev. p. 1267 (2017)"},{"key":"745_CR6","doi-asserted-by":"crossref","unstructured":"Chaabane, A., Manils, P., Kaafar, M.A.: Digging into anonymous traffic: a deep analysis of the tor anonymizing network. In: 2010 Fourth International Conference on Network and System Security, pp. 167\u2013174 (2010)","DOI":"10.1109\/NSS.2010.47"},{"key":"745_CR7","doi-asserted-by":"crossref","unstructured":"Kiran, K., Chalke, S.S., Usman, M., Shenoy, P.D., Venugopal, K.: Anonymity and performance analysis of stream isolation in Tor network. In: 2019 10th International Conference on Computing, Communication and Networking Technologies (ICCCNT), pp. 1\u20136 (2019)","DOI":"10.1109\/ICCCNT45670.2019.8944443"},{"key":"745_CR8","doi-asserted-by":"crossref","unstructured":"Oda, T., Obukata, R., Yamada, M., Ishitaki, T., Hiyama, M., Barolli, L.: A Neural network based user identification for Tor networks: comparison analysis of activation function using Friedman test. In: 2016 10th International Conference on Complex, Intelligent, and Software Intensive Systems (CISIS), pp. 477\u2013483 (2016)","DOI":"10.1109\/CISIS.2016.89"},{"key":"745_CR9","unstructured":"U.S. Department of Justice. South Korean National and Hundreds of Others Charged Worldwide in the Takedown of the Largest Darknet Child Pornography Website, Which was Funded by Bitcoin. https:\/\/www.justice.gov\/opa\/pr\/south-korean-national-and-hundreds-others-charged-worldwide-takedown-largest-darknet-child (2019). Accessed 8 Sept 2020"},{"key":"745_CR10","doi-asserted-by":"publisher","first-page":"448","DOI":"10.1016\/j.future.2016.05.018","volume":"80","author":"JH Ziegeldorf","year":"2018","unstructured":"Ziegeldorf, J.H., Matzutt, R., Henze, M., Grossmann, F., Wehrle, K.: Secure and anonymous decentralized bitcoin mixing. Futur. Gener. Comput. Syst. 80, 448 (2018)","journal-title":"Futur. Gener. Comput. Syst."},{"issue":"4","key":"745_CR11","doi-asserted-by":"publisher","first-page":"305","DOI":"10.1007\/s11896-016-9223-8","volume":"32","author":"PQ Brady","year":"2017","unstructured":"Brady, P.Q.: Crimes against caring: exploring the risk of secondary traumatic stress, burnout, and compassion satisfaction among child exploitation investigators. J. Police Crim. Psychol. 32(4), 305 (2017)","journal-title":"J. Police Crim. Psychol."},{"issue":"3","key":"745_CR12","doi-asserted-by":"publisher","first-page":"433","DOI":"10.1007\/s12103-017-9417-3","volume":"43","author":"GW Burruss","year":"2018","unstructured":"Burruss, G.W., Holt, T.J., Wall-Parker, A.: The hazards of investigating internet crimes against children: digital evidence handlers\u2019 experiences with vicarious trauma and coping behaviors. Am. J. Crim. Justice 43(3), 433 (2018)","journal-title":"Am. J. Crim. Justice"},{"key":"745_CR13","doi-asserted-by":"crossref","unstructured":"Dingledine, R., Mathewson, N., Syverson, P.: Tor: The second-generation onion router. Tech. rep., Naval Research Lab Washington DC (2004)","DOI":"10.21236\/ADA465464"},{"key":"745_CR14","unstructured":"Zantout, B., Haraty, R., et\u00a0al.: I2P data communication system. In: Proceedings of ICN, pp. 401\u2013409 (2011)"},{"key":"745_CR15","doi-asserted-by":"crossref","unstructured":"Clarke, I., Sandberg, O., Wiley, B., Hong, T.W.: Freenet: a distributed anonymous information storage and retrieval system. In: Designing Privacy Enhancing Technologies, pp. 46\u201366 (2001)","DOI":"10.1007\/3-540-44702-4_4"},{"issue":"4","key":"745_CR16","doi-asserted-by":"publisher","first-page":"2324","DOI":"10.1109\/COMST.2021.3093615","volume":"23","author":"I Karunanayake","year":"2021","unstructured":"Karunanayake, I., Ahmed, N., Malaney, R., Islam, R., Jha, S.K.: De-anonymisation attacks on Tor: a survey. IEEE Commun. Surv. Tutor. 23(4), 2324 (2021)","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"745_CR17","doi-asserted-by":"crossref","unstructured":"Biryukov, A., Pustogarov, I., Thill, F., Weinmann, R.P.: Content and popularity analysis of Tor hidden services. In: 2014 IEEE 34th International Conference on Distributed Computing Systems Workshops (ICDCSW), pp. 188\u2013193 (2014)","DOI":"10.1109\/ICDCSW.2014.20"},{"key":"745_CR18","doi-asserted-by":"crossref","unstructured":"Faizan, M., Khan, R.A.: Exploring and analyzing the dark web: a new alchemy. First Monday 24(5) (2019)","DOI":"10.5210\/fm.v24i5.9473"},{"key":"745_CR19","doi-asserted-by":"crossref","unstructured":"Ghosh, S., Das, A., Porras, P., Yegneswaran, V., Gehani, A.: Automated categorization of onion sites for analyzing the darkweb ecosystem. In: Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 1793\u20131802 (2017)","DOI":"10.1145\/3097983.3098193"},{"issue":"5","key":"745_CR20","doi-asserted-by":"publisher","first-page":"774","DOI":"10.1111\/add.12470","volume":"109","author":"MJ Barratt","year":"2014","unstructured":"Barratt, M.J., Ferris, J.A., Winstock, A.R.: Use of Silk road, the online drug marketplace, in the United Kingdom, Australia and the United States. Addiction 109(5), 774 (2014)","journal-title":"Addiction"},{"issue":"11","key":"745_CR21","doi-asserted-by":"publisher","first-page":"1113","DOI":"10.1016\/j.drugpo.2015.01.008","volume":"26","author":"DS Dolliver","year":"2015","unstructured":"Dolliver, D.S.: Evaluating drug trafficking on the Tor network: silk road 2, the sequel. Int. J. Drug Policy 26(11), 1113 (2015)","journal-title":"Int. J. Drug Policy"},{"key":"745_CR22","doi-asserted-by":"crossref","unstructured":"Lee, S., Yoon, C., Kang, H., Kim, Y., Kim, Y., Han, D., Son, S., Shin, S.: Cybercriminal minds: an investigative study of cryptocurrency abuses in the dark web. In: Network and Distributed System Security Symposium, pp. 1\u201315 (2019)","DOI":"10.14722\/ndss.2019.23055"},{"key":"745_CR23","doi-asserted-by":"crossref","unstructured":"Eldefrawy, K., Gehani, A., Matton, A.: Longitudinal analysis of misuse of bitcoin. In: International Conference on Applied Cryptography and Network Security, pp. 259\u2013278 (2019)","DOI":"10.1007\/978-3-030-21568-2_13"},{"key":"745_CR24","doi-asserted-by":"crossref","unstructured":"Kumar, R., Yadav, S., Daniulaityte, R., Lamy, F., Thirunarayan, K., Lokala, U., Sheth, A.: eDarkFind: Unsupervised multi-view learning for Sybil account detection. In: Proceedings of The Web Conference 2020, pp. 1955\u20131965 (2020)","DOI":"10.1145\/3366423.3380263"},{"key":"745_CR25","doi-asserted-by":"crossref","unstructured":"Yoon, C., Kim, K., Kim, Y., Shin, S., Son, S.: Doppelg\u00e4ngers on the dark web: a large-scale assessment on phishing hidden web services. In: The World Wide Web Conference, pp. 2225\u20132235 (2019)","DOI":"10.1145\/3308558.3313551"},{"key":"745_CR26","doi-asserted-by":"publisher","first-page":"62","DOI":"10.1016\/j.diin.2017.12.003","volume":"24","author":"J Dalins","year":"2018","unstructured":"Dalins, J., Wilson, C., Carman, M.: Criminal motivation on the dark web: a categorisation model for law enforcement. Digit. Investig. 24, 62 (2018)","journal-title":"Digit. Investig."},{"key":"745_CR27","doi-asserted-by":"crossref","unstructured":"Victors, J.: The onion name system: Tor-powered distributed DNS for Tor hidden services. Master\u2019s thesis, Utah State University (2015)","DOI":"10.1515\/popets-2017-0003"},{"key":"745_CR28","unstructured":"Trac. Tor Rendezvous Specification-Version 3. https:\/\/gitweb.torproject.org\/torspec.git\/tree\/rend-spec-v3.txt (2015). Accessed 8 Sept 2020"},{"key":"745_CR29","unstructured":"Katmagic. Shallot. https:\/\/github.com\/katmagic\/Shallot\/ (2011). Accessed 8 Sept 2020"},{"key":"745_CR30","doi-asserted-by":"crossref","unstructured":"Rawat, R., Rajawat, A.S., Mahor, V., Shaw, R.N., Ghosh, A.: Dark web\u2014onion hidden service discovery and crawling for profiling morphing, unstructured crime and vulnerabilities prediction. In: Innovations in Electrical and Electronic Engineering: Proceedings of ICEEE 2021, pp. 717\u2013734 (2021)","DOI":"10.1007\/978-981-16-0749-3_57"},{"key":"745_CR31","first-page":"5","volume":"9","author":"V Ciancaglini","year":"2013","unstructured":"Ciancaglini, V., Balduzzi, M., Goncharov, M., McArdle, R.: Deepweb and cybercrime. Trend Micro Rep. 9, 5 (2013)","journal-title":"Trend Micro Rep."},{"key":"745_CR32","doi-asserted-by":"publisher","first-page":"S99","DOI":"10.1016\/j.diin.2012.05.011","volume":"9","author":"B Jones","year":"2012","unstructured":"Jones, B., Pleno, S., Wilkinson, M.: The use of random sampling in investigations involving child abuse material. Digit. Investig. 9, S99 (2012)","journal-title":"Digit. Investig."},{"issue":"2","key":"745_CR33","doi-asserted-by":"publisher","first-page":"103","DOI":"10.1007\/s11896-014-9148-z","volume":"30","author":"M Powell","year":"2015","unstructured":"Powell, M., Cassematis, P., Benson, M., Smallbone, S., Wortley, R.: Police officers\u2019 perceptions of their reactions to viewing internet child exploitation material. J. Police Crim. Psychol. 30(2), 103 (2015)","journal-title":"J. Police Crim. Psychol."},{"key":"745_CR34","doi-asserted-by":"crossref","unstructured":"Park, J., Mun, H., Lee, Y.: Improving tor hidden service crawler performance. In: 2018 IEEE Conference on Dependable and Secure Computing (DSC), pp. 1\u20138 (2018)","DOI":"10.1109\/DESEC.2018.8625103"},{"key":"745_CR35","unstructured":"Poulsen, K.: FBI admits it controlled tor servers behind mass malware attack. Retrieved September 9, 2014 (2013)"},{"key":"745_CR36","first-page":"229","volume":"1","author":"K Wo\u0142k","year":"2014","unstructured":"Wo\u0142k, K., Marasek, K.: A sentence meaning based alignment method for parallel text corpora preparation. New Perspect. Inf. Syst. Technol. 1, 229\u2013237 (2014)","journal-title":"New Perspect. Inf. Syst. Technol."},{"key":"745_CR37","doi-asserted-by":"crossref","unstructured":"Zulkarnine, A.T., Frank, R., Monk, B., Mitchell, J., Davies, G.: Surfacing collaborated networks in dark web to find illicit and criminal content. In: 2016 IEEE Conference on Intelligence and Security Informatics (ISI), pp. 109\u2013114 (2016)","DOI":"10.1109\/ISI.2016.7745452"},{"key":"745_CR38","doi-asserted-by":"crossref","unstructured":"Kanemura, K., Toyoda, K., Ohtsuki, T.: Identification of darknet markets\u2019 bitcoin addresses by voting per-address classification results. In: 2019 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), pp. 154\u2013158 (2019)","DOI":"10.1109\/BLOC.2019.8751391"},{"issue":"2","key":"745_CR39","doi-asserted-by":"publisher","first-page":"102","DOI":"10.1057\/s41284-018-0150-5","volume":"32","author":"M Mirea","year":"2019","unstructured":"Mirea, M., Wang, V., Jung, J.: The not so dark side of the darknet: a qualitative study. Secur. J. 32(2), 102 (2019)","journal-title":"Secur. J."},{"key":"745_CR40","doi-asserted-by":"crossref","unstructured":"Pastrana, S., Hutchings, A., Thomas, D., Tapiador, J.: Measuring ewhoring. In: Proceedings of the Internet Measurement Conference, pp. 463\u2013477 (2019)","DOI":"10.1145\/3355369.3355597"},{"key":"745_CR41","doi-asserted-by":"crossref","unstructured":"Barr-Smith, F., Wright, J.: Phishing with a darknet: imitation of onion services. In: 2020 APWG Symposium on Electronic Crime Research (eCrime), pp. 1\u201313 (2020)","DOI":"10.1109\/eCrime51433.2020.9493262"}],"container-title":["International Journal of Information Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-023-00745-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10207-023-00745-4\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-023-00745-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,10,26]],"date-time":"2024-10-26T15:48:41Z","timestamp":1729957721000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10207-023-00745-4"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,8,22]]},"references-count":41,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2024,2]]}},"alternative-id":["745"],"URL":"https:\/\/doi.org\/10.1007\/s10207-023-00745-4","relation":{},"ISSN":["1615-5262","1615-5270"],"issn-type":[{"value":"1615-5262","type":"print"},{"value":"1615-5270","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,8,22]]},"assertion":[{"value":"22 August 2023","order":1,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no conflicts of interest regarding the publication of this study.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"In this study, we have established the following ethical policies, followed them strictly, and conducted research, based on the ethical implementation considered in previous studies [\u2013]. (1) If a word related to illegality is found on a website, we extract and analyze only the text data of the website. For example, if the word \u2018child\u2019 is found, even if it is not actually an illegal site, only text data is extracted and then analyzed because the web page may contain CSAM. (2) When the disturbing image detector determined that a crawled dark website has illegal images, we extract and analyze only the text data. The illegal image is not stored in our system. (3) We do not access the sub-URL collected by the machine in the dark web. We focus on the evidence found on the main page. Special judicial police officer of Korea Copyright Protection Agency (KCOPA) conducted an ethical review of this study. The websites were reported to the police. Under the supervision of the agency, we did not share information without approval. The source code was also not disclosed due to potential abuse.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical approval"}},{"value":"This article does not contain any studies with human participants or animals performed by any of the authors.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Human rights"}}]}}