Computer Science 22: Research on TOR Browser and Dream Market Analysis

This computer science report delves into the analysis of the TOR browser and the Dream Market, a darknet marketplace, focusing on data mining techniques and the identification of NPS (New Psychoactive Substances) drugs. The report begins with background information on the TOR browser, its features, and the emergence of marketplaces like Dream Market. It then poses research questions regarding the demographics of sales, vendor trustworthiness, and optimal data mining methods. The study addresses the challenges of excessive data and the need for data preprocessing, outlining the objectives of providing qualitative and quantitative information, ensuring timely information, and removing redundant data. The research employs various data mining techniques, including classification, prediction, decision trees, clustering, and ensemble methods, with a focus on decision trees and ensemble methods for improved performance. The scope of the research includes the application of descriptive and quasi-experimental methods, specifically focusing on filtering mechanisms and mining illegal products. The report highlights the significance of the research in understanding data flows, privacy, and the importance of TOR browser over other browsers. The informatics artifacts include RAM capacity and page file analysis. The study aims to identify patterns in NPS drug transactions and the trustworthiness of vendors over time, using data collected from the Dream Market. The report also provides a detailed analysis of the NPS drugs identification in Dream Market, the effects of NPS drugs, and the overall aim of exploring illicit NPS drug transactions in Dream Market. The report also provides a comprehensive overview of the problem statement, objectives, significance, and scope of the research, along with the informatics artifacts used.

Running Head: COMPUTER SCIENCE 1
Computer Science
Name
School Affiliation

COMPUTER SCIENCE 2
CHAPTER 1
INTRODUCTION
1.1. Background
TOR browser stands for The Onion Router which was started in the 1990’s by a group of
people at U.S Naval Research Lab (NRL). The increased insecurity and the ability to monitor
and traffic analysis brought a great concern. Mathematician Paul Syverson and computer
scientists Mike Reed and David Goldschlag saw that there was a need to develop more secure
internet connection that does not give information of who is communicating to whom even to
someone keeping track of the network. Their intention was to create and develop a unique design
and prototypes of onion routing (Gallagher, K., Patil, S., Dolan-Gavitt, B., McCoy, D., & Memon, N.,
2018, October).
The aim of onion routing was to enable internet user to surf the internet with as much
privacy as it is practically possible, through routing traffic by using multiple servers and
encrypting. Onion routing manifested through encryption in the application layer of the
communication protocol. TOR encrypt and decrypt data sent through a virtual circuit by not
revealing the next destination IP address.
TOR has several features, which includes,
The ability to block trackers. This features protects the internet browsers from the third parties
and being followed by ads while browsing.
It enables free browsing. A person using TOR browser has an advantage over other browsers
because TOR gives access to sites that are blocked by the other browsers.

COMPUTER SCIENCE 3
Resist fingerprinting. TOR ensure that all people using the internet look the same. This makes it
very hard to pick point a particular browser.
Its capability to hide IP source
Portability. You can use a pre-configured browser using a USB device storage without
necessarily installing it in your device.
Has multilayered encryption. Traffic is relayed and encrypted 3 times through TOR relays.
It defends against surveillance. This means that can’t know what you browse and what website
you visit.
Research Question:
What would will be the demographic of sales and product?
Due to TOR features it has led to emergency of several market places such as Alpha Bay,
Outlaw Market and Dream Market. In these markets all sorts of products be it legal or illegal are
sold. Dream Market for example is an online dark net market which was founded in 2013 which
depends on hidden services of TOR to run. This market place is popular because it sells a variety
of products which includes, fake consumer goods, stolen data, coins laundry, digital goods and
drugs through crypto coins. Due to shutdown of AlphaBay and Hansa market, people thought
that Dream market would be the prevalent darknet market place. As a result of the seizure of
AlphaBAy and Hansa market Dream market gained popularity and became the second largest
marketplace (Mackey, T., Kalyanam, J., Klugman, J., Kuzmenko, E., & Gupta, R., 2018). This led to
many buyers and sellers from AlphaBay and Hansa to register on Dream market.

COMPUTER SCIENCE 4
Anybody can access Dream market regardless of their age, level of income, education, location,
gender and race. This will mean that Dream market will reach out to all customers and satisfy
their needs accordingly.
- What contribute to work trustworthiness of vendor?
The creation of escrow technologies which provides protection against scams by having a
third party that is entrusted with the money until the buyer and seller certify the products have
been successfully delivered.
Reduction of intermarket competition which makes Dream Market to focus on their own
market by improving their security so as to prevent them from hackers, message encryption and
two-factor authentication.
Another way that contributes to work trustworthiness of a vendor is by checking on the
rating and feedback given by other customers. Costumers will tend to go for a vendor who has
high rating and positive feedback and comments given from previous transactions.
Which is the optimal data mining technique and ensemble method to evaluate the result?
Among the various data mining techniques, the most applicable methods in this research will be
classification which will involve grouping of various products.

COMPUTER SCIENCE 5
1.2. Problem Statement
Too much data,
TOR browser will tend to attract a lot of people, both buyers and sellers in the markets
taking advantage of the fact that no one can track them down or find out what they are doing.
This will mean that there will be too much information found here. Vendors both scams and
trustworthy will describe their variety of products during marketing, this gives the buyers a hard
time finding what they want. This is a major problem even for researchers who may be trying to
track down someone too much data will make it hard to concentrate on the major course of the
study.
Take time to clean all unnecessary data
TOR browser is a heavily encrypted site which involves a lot of security questions and
steps for anyone to register. For example, if a client is registering for the first time in the web
they may give information which isn’t needed. It very hard to distinguish what information is
more useful and which is not. In case one is not careful enough they might be a great data lose
which may take long time to recover. In formation in this web browser is of great importance and
one should be very vigilant while cleaning unwanted data. TOR browser is heavily concealing
web using programming languages and codes.
It take time to encrypt sent messages and distinguish which message is no longer in use.
After the information is decrypted, you have to go through security steps to verify that you are
the owner of the account which may be hard. Hacker and other unauthorized people may take
this chance to exploit sensitive data.

COMPUTER SCIENCE 6
Just like any other system TOR has its own weakness, first users are constantly hacked
probably because the user’s device are not well protected. Also, one can still be tracked online
even when using tor browser because of poor exist nodes of your destination.
1.3. Objectives of the Research
Data processing. The main concept of data processing is sorting, storing and retrieval
of data at short intervals. Through methods such as collecting, organizing, sorting, modifying,
publishing and destroying data. Objects of data processing includes.
To provide qualitative and quantitative information. This will help give qualitative and
qualitative information about each product that has been identified. This will come in handy
when it comes to grouping and sorting the products according to their characteristics.
To provide proper and timely information. Different kind of information will be needed in
every step of the way. Data processing will provide the most correct and timely information
where necessary.
Storage and retrieval of data. Through various methods of data processing, stored data
can be when necessary as it is required.
Uphold research performance at optimum level. Well organized data will ensure that the
research goes on well with minimum difficulties in handling data. This is because well-organized
data will provide a smooth flow of various operations at different stages of the research thus
there will be no or minimum time wastage.
Helps in decision making. When effective data processing method is used, it will be very
easy in decision making since good information is provided before any action is taken. In this

COMPUTER SCIENCE 7
research, it will help in making decision on which group a certain product will be placed with
enough supporting information.
To remove redundant data. Through sorting it becomes easy to eliminate data that is
repeated or not useful anymore. Such data can be destroyed or put in various groups.
To protect the data from harm be it physical or unauthorized access. Grouped data is
very easy to protect. According to nature of information contained or the method of grouping
used, each data can be assigned security protocol.
Evaluate and benchmark several data using data mining algorithm
Data mining techniques includes, classification, clustering, prediction, sequential patterns
and decision tree.
Classification.-this involves putting things in a predefined group or classes. This
technique is very important in this research people it involves different products some which can
be put in groups based on their common characteristics. This will help put this products in
groups such as legal and illegal goods.
Prediction – this discovers relationship of situation and the possible outcome. This
technique in this concept will help understand the nature of some products based on the
customers’ expectations.
Decision trees-in this technique the root of the decision tree is a very simple question
based on the products that helps in determining the data so that a final decision can be made.

COMPUTER SCIENCE 8
Clustering – makes a useful cluster of product which have similar characteristic using
automatic technique. This works hand in hand with classification because it defines classes and
put each product accordingly into different groups.
Association.-a pattern is noticed according to relationship between items in the same
transaction.
Ensemble by assembling several data mining to have better performance.
Ensembling is a set of procedure used to run two or more related but different analytical
models and then combining the output into a single spread in order to improve the accuracy of
predictive data mining applications. Ensembles can give an important boost to industrial
problems such as investment timing to drug discovery. Drug discovery in this context is very
important since this drugs are being sold in TOR Dream market.
Decision trees are most applicable since it will help in determining the data so that a final
decision can be made. The following are the major divisions of ensembling methods;
Sequential ensemble method. This is where base learners are produced in a certain order.
The main objective of this method is to advantage of the dependence among the base learners.
Parallel ensemble method. In this method base learners are produced in parallel. The
main objective of the method is to take advantage of the independence between the base learners
because errors can be made less by averaging.

COMPUTER SCIENCE 9
1.4. Significant of Research
We live in an age where data flows freely that is anyone with internet access has the
power to acquire all the information they need. With the major improvement on the internet it
has led to many complication in the way we share knowledge and our privacy.
Why we prefer TOR browser over the other browsers such as chrome safari and Firefox;
In other websites one is directly connected to the site they are trying to visit. This is risky
since websites can see who you are and what you are trying to do. However, TOR passes your
information or data through a network of relay nodes using layers of encryption. Each relay your
data go through brings another encrypted layer. The data goes through several nodes before
peeling off the last encryption layer. Once the last encryption layer is done the data is delivered
to the intended server (Kohlbrenner, D., & Shacham, H., 2016). The fast and the last node are
completely hidden. Another importance of TOR is how the packets are constructed. These
packets have sender address and destination address which are arranged in layers unlike in a
letter.
1.5. Scope of Research
Among the many methods of research, the most applicable one is descriptive method
which entails survey, historical, content analysis and qualitative techniques. Quasi experimental
can also be used in some extent. The research will be based on the TOR browser and specifically
Dream market which makes use of TOR browser system. The research will be focused on
filtering mechanism which involves use of a computer program to screen and exclude
availability web pages that are considered objectionable, preprocessing and mining illegal

COMPUTER SCIENCE 10
products that are sold through Dream market. The information obtained will be useful in
different fields including security and education.
1.6. Informatics Artefact
RAM capacity- the synthesis of RAM contents provides the researchers with information
about downloaded data and file types.
Page file- pagefile.sys entails information about HTTP while the browser is surfing
privately.
\Data\TOR-information is contained in two categories that is; state which gives the last
date that the program was executed and tor that shows the location from where TOR browser
was launched.
Prefetch file- conducted though registry analysis to give information of the TOR
installation, the last time it was accessed and the location it was accessed from.
\Data\browser - it is a folder that contain the user profile but necessarily show traces of
usage. Entails two files that show the execution path that is; Extension.ini and compatibility.ini.

COMPUTER SCIENCE 11
CHAPTER 2
LITERATURE REVIEW
2.1 Introduction
Web browsers are the most common used applications to access any website and privacy
is one of the factors that many people who access the internet are considering in this 21st century.
No one is willing to be monitored the way he or she access the website as many when access the
sites look for content that is more private or maybe they have bad intentions to perform on the
website. Cyber attacks activities are increasing as many business ventures are doing transactions
online and they do not want to be monitored as well (Bauer, M., 2015). TOR we browser has been
the solution to those who want to access the websites, but they do not want to be monitored.
TOR browser helps them to access the websites anonymously such that their location
cannot be known, nor they cannot be controlled by cookies and other security features on the
internet. Though it has provided malicious user with an opportunity to browse with a lot of
freedom from being caught, it has also helped those who want to do safe transactions but in a
private way. TOR changes your IP address to any other address of your wish so that you can not
be seen in your real location making them anonymous over the internet.
Many data mining clients like using this browser for privacy purposes as it protects them
from attackers because their IP changes dynamically making it hard for the attackers to see them
in any way. Many times, customers who transact with Bitcoin really prefer to use TOR web
browser as it helps them to move anonymously over the internet in a safe way. Some of these
transaction are illegal ones and that is why they prefer accessing the Bitcoin website with TOR
browser while others try to evade the attackers over the internet.

COMPUTER SCIENCE 12
How it works
TOR browser is liked by many users who like privacy because using the known Tor
network it anonymizes the traffic on the web and this helps to protect your possible identity over
the internet. For example, those that are doing business and they want to improve their business
by doing enough research maybe to know how they can market their products to improve sales
and their revenues and mostly want to learn how their competitors market themselves, mostly
they opt to use TOR browser so that their competitors cannot notice them when doing the
research on marketing which is similar to the way they market their products.
Tor connects to the websites in a random way using a code that is used to bounce a traffic
randomly selected from the middle and then splits it using the final code. Tor is made up of
three-layer proxy and that that’s why its official logo consists of three-layer onion structure.
Who uses it?
TOR browser though has got advantages to those users whom prefer privacy most over the
internet it is slow when accessing websites than when one using the normal browsers like
chrome and other browsers. Tor being illegal in some of the countries is caution for users to
know that when accessing government services and some sites blocks Tor browser users. This
helps to protect the government services from being accessed by unauthorized people who can
bring harm to the government (Winter, P., Edmundson, A., Roberts, L. M., Dutkowska-Żuk, A., Chetty,
M., & Feamster, N., 2018). Because some governments like practicing dictatorship mode of
leadership, journalist globally have embraced Tor browser as the cornerstone of democracy