Interaction of Structure and Information on Tor

Tor is the most popular dark network in the world. It provides anonymous communications using unique application layer protocols and authorization schemes. Noble uses of Tor, including as a platform for censorship circumvention, free speech, and information dissemination make it an important socio-technical system. Past studies on Tor present exclusive investigation over its information or structure. However, activities in socio-technical systems, including Tor, need to be driven by considering both structure and information. This work attempts to address the present gap in our understanding of Tor by scrutinizing the interaction between structural identity of Tor domains and their type of information. We conduct a micro-level investigation on the neighborhood structure of Tor domains using struc2vec and classify the extracted structural identities by hierarchical clustering. Our findings reveal that the structural identity of Tor services can be categorized into eight distinct groups. One group belongs to only Dream market services where neighborhood structure is almost fully connected and thus, robust against node removal or targeted attack. Domains with different types of services form the other clusters based on if they have links to Dream market or to the domains with low/high out-degree centrality. Results indicate that the structural identity created by linking to services with significant out-degree centrality is the dominant structural identity for Tor services.