Unmasking the dark web: Machine learning meets the Tor network

Anonymity in the digital world is a double-edged sword. On one hand, it protects whistleblowers, journalists, political dissidents, and ordinary citizens who seek privacy online. On the other hand, it creates opportunities for cybercriminals to operate out of sight, running underground markets, hosting illicit content, or controlling malware infrastructure. As the demand for privacy grows, so does the complexity of understanding, monitoring, and securing the spaces that provide it.

This talk will explore the landscape of online anonymity, beginning with a broad overview of what anonymity means in cyberspace. We will examine why users seek it, how it is achieved technically, and the ethical and security implications that come with it. From there, we will narrow our focus to the most widely used anonymity network in the world: Tor.

Tor is the backbone of the dark web, enabling users to browse anonymously and access onion services, which are websites hosted within the Tor network. These services form a significant part of the dark web and are used for both legitimate and illicit purposes. By encrypting traffic and routing it through multiple nodes, Tor conceals both the identity of the user and the location of the service. This makes it a powerful tool for anonymity, but also a difficult one to monitor for malicious activity.

At the same time, security researchers, law enforcement agencies, and even the Tor Project itself have been working on methods to analyse and understand Tor traffic. These include traffic analysis, fingerprinting, and the use of machine learning to identify patterns or potential threats. In response, the Tor team continues to develop techniques to make traffic analysis more difficult, improving the anonymity guarantees the network provides.

My research focuses on how machine learning can be used to analyse Tor network traffic. I will share key insights from my PhD work, which looked at how different types of Tor traffic can be classified to support cybersecurity operations. This includes identifying hidden services, analysing website fingerprinting techniques, and detecting malware communication patterns within the network. The goal of this research is not to break anonymity, but to better understand how these tools are being used or misused in real-world scenarios.

I will also touch on how these insights can be used to inform threat intelligence, design better defences against anonymised malware, and contribute to the responsible development of privacy-preserving technologies.

By the end of the session, attendees will have a clearer understanding of how the dark web works, how anonymity is built and protected, and how researchers and practitioners can walk the fine line between preserving privacy and securing systems. This talk invites the audience to think critically about both the promise and the challenges of an anonymous internet.