Many people think that the Internet and web are synonyms. In fact, they are two different terms with common elements. The Internet includes multiple networks and their massive infrastructure. It enables the connection of a million computers by creating a network in which any computer can communicate with other computers as long as they are connected to the Internet  . The web (a medium) provides access to information. In terms of conceptualization, the web is a content made up of accessible web sites through search engines such as Google, Firefox, etc. This content is known as “Surface Web” (Figure 1)     .
Another part of the Internet is the Deep Web (Figure 1), which is referred a class of its content where for different technical reasons, it is not indexed by search engines and we cannot access via traditional search engines. It includes information on the private networks and intranets (agencies, universities, companies, commercial databases, etc.), sites with queries content or searching forms. Deep Web is segmented further as the Dark Web (Figure 1). Its content is intentionally hidden and cannot be accessed by standard web browsers   .
The sites’ publishers on the Dark Web are anonymous and hidden. Users are accessed on the Dark Web to share data with little risk and to be undetected (anonymous). The access of users anonymously is essential for the Dark Web, which recently it is supported by the encryption tunneling for monitoring protection. The Dark Web content is supported by the Onion Routing (TOR). It is anonymous network and access by the TOR browser. The TOR project was launched in 2002 by the US Naval Research laboratory to enable online anonymous
Figure 1. The Internet layers  .
communication. Invisible Internet Project (I2P) is another network on the Internet with the traffic in its borders and it is used for anonymous communication, users’ traffic encryption, etc. It provides more robust and reliability of the networked networks   . In the Dark Web, the possibility of user detection is low and this has favored the development of legal and illegal activities among the traffic of this segment of the Internet  .
Dark web can be achieved through anonymous and decentralized nodes of certain network groups (TOR or I2P). TOR has the software name that we install on the computer and the computer network that care and manage its connections. It enables users to access websites through virtual tunnels where people and organizations can distribute data through public networks without compromising their privacy. TOR enables users to route their traffic through “users’ computers” so in order that traffic is not traced back to the originating users and conceal their identity. To pass the data from one layer to another layer, TOR has created “relays” on computers that carry information through its tunnels all over the world. The encrypted information is placed between the relays. TOR traffic as a whole goes through three relays and then it is forwarded to the final destination  .
“Exit relay” is called the final relay. The IP address of this relay resembles with the TOR traffic source. With the use of TOR, software is possible to hide the addresses of the users. Browsing websites through TOR enables the display of the link for the given web page (in the background of it exists the IP address of the exit relay of TOR). To have more security, anonymity and privacy during the communication, individuals should use e-mails, web chats or similar communications’ platforms hosted in TOR  .
2. Related Work
There are an increasing number of research papers and projects related to the Dark Web. In terms of the related works, the importance and the essentiality of the project have been the focus of improving the surveillance regarding the state  . The exchange of the weapons and the occurrence of the child pornography are easily conducted with the help of the Dark Web. The distribution of the network analysis with the help of the TOR network, and the users can easily afford the anonymous anonymity of the process. Therefore, for the conduct of the in-depth analysis, the various works of literature provide for the enhancement of the research, and thereby the TOR routing with the other principles is providing with the help of the various US intelligence systems. It not only enables the Dark Web process for the licit purpose, but the illicit purpose also.
The privacy of the system with depicting the appropriate analysis of the trackers of the network is being easily depicted for the purpose of analyzing the fact and also the research is being continued by the help of the ISI research frameworks  . The conduct of the literature review is based on the detailed research on the various parts of the Dark Web which is being explained in an appropriate way. The research also helps in depicting the appropriate facts regarding the research which was conducted by the researcher.
In another work of Barnett et al.,  the role of the spiders (defined as the software programs that are used to transverse the World Wide Web information) and the easy accessibility that can be achieved by the process of handling the registration and thereby the exact and the desired information about the various types can be easily collected, is studied.
The social network analysis (SNA) is a topic of interest in  and is being conducted for the purpose of obtaining the graph-based methods, and thereby the analysis of the network group becomes easier with depicting the group or the population strength. The impact of the social interactions is widely depicted by the usage of the social networks, and thereby the real world networks can be easily identified.
Different SNA techniques have developed for examining forum posting and website relationships. The main focus is on understanding the “dark networks” and their unique properties  . Detailed coding schemes have been developed to evaluate the extremist websites and terrorist contents.
The sentiment and affect analysis allow determining violent and radical sites that impose significant threats  .
Terrorism informatics is referred to as the application of advanced information fusion, analysis techniques and methodologies to acquire process, integrate, manage and analyze the diversity of the information related to terrorism for international/national security applications. The technique is derived from the disciplines such as informatics, mathematics, science, statistics, social sciences, public policy, and linguistics. The research shows terrorism involves a huge amount of information from different sources, languages, data types, information fusion and analysis, such as text mining, data mining, language translation, data integration, video and image processing helps to detect and prevent terrorism  .
The identification of fraud and theft are relevant at both the national and international level, since criminals may escape by using false identities, and the smugglers can also enter the country by holding fake visas or passports  . Internet fraud, network hacking, intrusion, illegal trading, hate crimes, virus spreading, cyber pornography, cyber privacy, theft of the confidential information and cyber terrorism, narcotics trafficking and terrorism have no boundaries and are a security concern globally.
3. Techniques, Attributes, Accessing and Communication in the Dark Web
Anonymity  in the Dark Web derives from the Greek word “anonymia” that refers hiding of the personal identity from others. When we make any action on the web, our footprints deposited as data on the Internet. If the Internet Protocol address cannot be tracked, then we can say that anonymity is guaranteed. TOR client via volunteer server networks route the Internet traffic over the world. This makes it to conceal user information and avoid any possibility of monitoring activities. Dark Web also has negative effects by allowing criminals to commit cybercrime and conceal their traces  .
It is considered to be an adequate channel for governments to exchange secret documents, for journalists as a bypass for censorship and for dissidents as a possibility “to escape” from authoritarian regimes. The onion technique1 enables anonymous communications through a network of computers. Messages are sent encrypted (using the asymmetric encryption) then they are sent through some nodes of networks known as onion routers. When the message is sent to the onion routers, each onion router deletes the encryption layer in the same way as remove the onion peeling to not discover the routing instructions, so a message is sent to the other router and this process is repeated until it is sent to a specific destination (Figure 2). This technique protects the intermediate nodes form “being informed” about the source, destination and message content    .
4. Online Privacy in the Dark Web
TOR is used to enable private, anonymous and secure communications and activities for specific purposes   . In the following are given some examples that they are related to above mentioned elements:
Figure 2. The message routing by using the onion technique2.
・ Anti-censorship and political activities. To avoid censorship and to reach certain destinations or contents that they are blocked in one or another way, TOR considers as an adequate tool. It enables individuals to access contents that may be blocked in certain parts of the world. To stop it, some governments have established rules for using TOR, or blocking access to TOR for the specific time periods. TOR is also used by political dissidents to secure and maintain their anonymous communications and locations. Such a case is the movements of dissidents in Iran and Egypt  .
・ Sensitive communications. If the individuals want to access in chat rooms or forums and they like to do the sensitive communications for personal or business purposes, this is enabled by TOR. It is used to protect children online (the Internet browsing) to avoid them from abuse activities (by hidden IP addresses of their devices). This tool can be used by businesses to protect their projects and to fence spies from their competitors    .
・ Leaked information. TOR can be used from journalists to communicate securely with informers and dissidents   . Individuals have the possibility to communicate and share documents anonymity with publishers thought TOR, e.g., the New Yorker’s Strongbox. Edward Snowden has used Tail (an operating system for anonymity) that runs in TOR. He has reported and communicated to journalists for disclosing the classified documents about defense programs of the USA. Snowden disclosed a top secret document which described how the National Security Agency (NSA) tried to use the TOR browser to de-anonymized users  .
5. Dark Web in the Government, Military and Intelligence
Because of the anonymity provided by Tor and other software such as I2P, the Dark Web can be a playground for nefarious actors online. As noted, however, there are a number of areas in which the study and use of the Dark Web may provide benefits. This is true not only for citizens and businesses seeking online privacy, but also for certain government sectors―namely the law enforcement, military, and intelligence communities.
Anonymity on the Dark Web can be used to shield military command and control systems in the field for identification and hacking by adversaries. The military may use the Dark Web to study the environment in which it is operating as well as to discover activities that present an operational risk to troops. For instance, evidence suggests that the Islamic State (IS) and supporting groups seek to use the Dark Web’s anonymity for activities beyond information sharing, recruitment, and propaganda dissemination, using Bitcoin to raise money for their operations. In its battle against IS, the Department of Defense (DOD) can monitor these activities and employ a variety of tactics to foil terrorist plots  .
TOR software can be used by the military to conduct a clandestine or covert computer network operation such as taking down a website or a denial of service attack, or to intercept and inhibit enemy communications. Another use could be a military deception or psychological operation, where the military uses the Dark Web to plant disinformation about troop movements and targets, for counterintelligence, or to spread information to discredit the insurgents’ narrative. These activities may be conducted either in support of an ongoing military operation or on a stand-alone basis  .
DOD’s Defense Advanced Research Projects Agency (DARPA) is conducting a research project, called Memex, to develop a new search engine that can uncover patterns and relationships in online data to help law enforcement and other stakeholders track illegal activity. Commercial search engines such as Google and Bing use algorithms to present search results by popularity and ranking, and are only able to capture approximately 5% of the Internet  . By sweeping websites that are often ignored by commercial search engines, and capturing thousands of hidden sites on the Dark Web, the Memex project ultimately aims to build a more comprehensive map of Internet content. Specifically, the project is currently developing technologies to “find signals associated with trafficking in prostitution ads on popular websites”  . This is intended to help law enforcement target their human trafficking investigations  .
Similar to the military’s use of the Dark Web, the Intelligence Community’s (IC’s) use of it as a source of open intelligence is not a secret, though many associated details are classified. According to Admiral Mike Rogers, Director of the National Security Agency (NSA) and Commander of U.S. Cyber Command, they “spend a lot of time looking for people who don't want to be found”  . Reportedly, an investigation into the NSA’s XKeyscore program―one of the programs revealed by Edward Snowden’s disclosure of classified information―demonstrated that any user attempting to download TOR was automatically fingerprinted electronically, allowing the agency to conceivably identify users who believe themselves to be untraceable  .
While specific IC activities associated with the Deep Web and Dark Web may be classified, at least one program associated with Intelligence Advanced Research Projects Activity (IARPA) may be related to searching data stored on the Deep Web  . Reportedly, conventional tools such as signature-based detection don’t allow researchers to anticipate cyber threats; as such, officials are responding to rather than anticipating and mitigating these attacks  . The Cyber-attack Automated Unconventional Sensor Environment (CAUSE) program seeks to develop and test “new automated methods that forecast and detect cyber-attacks significantly earlier than existing methods.”  . It could use factors such as actor behavior models and black market sales to help forecast and detect cyber events  .
6. Payment on the Dark Web
Bitcoin is the currency often used in transactions on the Dark Web  . It is a decentralized digital currency that uses anonymous, peer-to-peer transactions  . Individuals generally obtain bitcoins by accepting them as payment, exchanging them for traditional currency, or “mining” them  .
When a bitcoin is used in a financial transaction, the transaction is recorded in a public ledger, called the block chain. The information recorded in the block chain is the bitcoin addresses of the sender and recipient. An address does not uniquely identify any particular bitcoin; rather, the address merely identifies a particular transaction  .
Users’ addresses are associated with and stored in a wallet  . The wallet contains an individual’s private key  , which is a secret number that allows that individual to spend bitcoins from the corresponding wallet  , similar to a password. The address for a transaction and a cryptographic signature are used to verify transactions  . The wallet and private key are not recorded in the public ledger; this is where bitcoin usage has heightened privacy. Wallets may be hosted on the web, by software for a desktop or mobile device, or on a hardware device  .
7. Results and Discussion
Results are derived based on research questions (RQ) mainly focused on TOR metrics information and different reliable Dark Web privacy (anonymity) reports and information. Through of them are given arguments about anonymity and privacy for different cases. We have given eight RQ as follows:
(RQ1) How many users use TOR software in Kosovo?
Based on data that we have generated from the TOR metrics, we find that the daily users of TOR software in Kosovo during January to December 2018 have been near 90. This cipher is increased and decreased during this period of time (Figure 3).
(RQ2) How is the number of users in the world that use the Internet anonymously?
Based on the TOR metrics, the daily users in the world that they have used the Internet anonymously during January to December 2018 was above 4 million in the two first months of 2018 and this cipher has fallen off after second month of the same year (Figure 4).
(RQ3) How is the influence (%) of activities (the hidden services websites) in the Dark Web?
According to the study of University of Portsmouth results that researchers have worked with 40 relays (computers) that ran on TOR network and they have collected above 45.000 TOR hidden services web sites. Researchers concluded that 2% of them were for children abuse and 83% of visitors have visited these sites. Another study is realized by King’s College London about the TOR hidden services web sites via search engines like Ahmia and Onion City (for the Dark Web). Researchers have identified 5.205 websites live. 1.557 of them is identified by illicit content. According to TOR project estimated that the traffic of hidden services is 3.4%. In March 2016 to March 2017 have existed between 50.000 - 60.000 daily hidden services (unique and with the onion addresses)   .
Figure 3. The TOR daily users in Kosovo during January to December 20183.
Figure 4. The TOR daily users in the world that they have used the Internet anonymously during January to December 20184.
(RQ4) Can anonymity be verified in the Dark Web and can we say that it is the anonymous content?
We cannot say that anonymity is completely verified on the Dark Web. TOR has purposed to enable anonymous activities, but researchers and security experts are continually working to develop tools through which they can identify individuals or hidden services and de-anonymize them. There are many cases (examples) about anonymity, but to elaborate this research question are considered two of them:
1) The Federal Bureau of Investigation (FBI) took in control the Freedom Hosting5 in 2013, even why many years ago, it had infected that with a malware designed to identify visitors. FBI, since 2002, has used “a computer and internet protocol address verifier”  that was a malware in the Freedom Hosting web hosting service, though of which it had identified and verified suspects and their location using a proxy server or anonymous services such as TOR.
2) Hackers who are part of Anonymous, in 2017 have reactivated and controlled the Freedom Hosting II, the web hosting service on the Dark Web and the predecessor of the Freedom Hosting. They claimed that over 50% of the Freedom Hosting content was related to sensitive content. Users who placed these data on the Freedom Hosting could easily be identified. Security experts have concluded that the Freedom Hosting II hosted 1500 - 2000 hidden services (near 15% - 20% of them were rated as active sites)  .
(RQ5) How the number of users is retrieved from the directory requests through TOR and in what way does their calculation become?
There are mechanisms in the TOR that make assumptions that clients make on average ten requests per day. A TOR client, if it is connected to the Internet 24/7, can make approximately fifteen requests per day, but not all clients stay connected to the Internet 24/7, so it takes into consideration average ten requests per client. The total number of directories’ requests that come from users divide by ten and it is found the number of users. Another way to calculate users is the assumption that each request represents a client who is on the Internet for 1/10 of a day (or 2 hours and 24 minutes).
(RQ6) How do we know from which countries are the Dark Web users and in what way does their reporting become?
The directories disassemble IP addresses according to country codes from where comes the access to them and report numbers in aggregate form. These numbers indirectly represent the Dark Web users. Since reporting is made in such form, it is considered a reason why TOR ships related to GeoIP database.
(RQ7) How can censorship events be identified/calculated through TOR?
There is an anomaly-based censorship detection system6 that calculates the number of users over a series of days and predicts how many users may be in the next few days. If the current number of users estimated to the above system is high, it can be concluded that there are possible censorship events, otherwise no. For more details about this issue please refer to the relevant report7.
(RQ8) How can users be numbered in an anonymous network in the Dark Web (according to the TOR Metrics)?
According to the TOR metrics8, the number of users is not directly calculated, but the requests of directories are numbered frequently for the clients and in this case the relay list is updated. Therefore, based on the above elements, indirectly counts the number of users in an anonymous network.
The Dark Web networks such as TOR have provided many possibilities for malicious actors to exchange legal and illegal “goods” anonymously. Dark Web is a growing asset, especially in terms of the illicit services and activities. Security mechanisms should be vigilant to these problems and take measures to eliminate them. The evolving technology with encryption (security) and anonymity (like the Dark Web and its special software) has put law enforcement and policymakers in challenge to effectively struggle harmful actors who are operating in the cyberspace.
In this paper, it is discussed for the impact of the Dark Web, respectively privacy and anonymity of it and through the results, it is shown the anonymous users daily number of this Internet segment for the Kosovo region as well as whole world and how much the impact of hidden services websites on the Dark Web is. The results of this part are gathered from Ahimia and Onion City search engines (for the Dark Web). We have concluded that anonymity is not completely verifiable on the Dark Web even through TOR is dedicated to this network segment which it has purposed to provide anonymous activities. Here is also retrieved the reporting aspect of users from which country they are. In this case, the directories disassemble IP addresses according to country codes from where comes the access to them and report numbers in aggregate form. These numbers indirectly represent the Dark Web users. The number of users in anonymous networks of the Dark Web is not directly calculated. This calculation is made through the TOR metrics where the client requests of directories are calculated an in this case the relay list is updated. Indirectly, the number of users in the anonymous network is calculated as a case is given through results in this paper.
1This is available at: Rola, I., Balzarotti, D. and Santos, I. (2017) The Onions Have Eyes: A Comprehensive Structure and Privacy Analysis of Tor Hidden Services. Proceedings of the 26th International Conference on World Wide Web, ACM, Perth, Australia, 1251-1260. https://doi.org/10.1145/3038912.3052657
2The onion routing is available at: https://en.wikipedia.org/wiki/Onion_routing.
3The daily users of TOR software in Kosovo based on the TOR metrics is available at: https://metrics.torproject.org/userstats-relay-country.html?start=2018-01-01&end=2018-12-01&country=xk&events=off
5For more information please refers at: https://en.wikipedia.org/wiki/Freedom_Hosting.
6The anomaly-based censorship detection system is available at: https://dl.acm.org/citation.cfm?id=3201093
7This report is available at: https://research.torproject.org/techreports/detector-2011-09-09.pdf.
8The TOR metrics information is available at: https://metrics.torproject.org/reproducible-metrics.html.
 Chertoff, M. and Simon, T. (2015) The Impact of the Dark Web on Internet Governance and Cyber Security. Centre for International Governance Innovation and Chatham House, 6, 1-18.
 Ilou, C., Kalpakis, G., Tsikrika, T., Vrochidis, S. and Kompatsiaris, I. (2016) Hybrid Focused Crawling for Homemade Explosives Discovery on Surface and Dark Web. Proceedings of the 11th IEEE International Conference on Availability, Reliability and Security, Salzburg, Austria, 15 December 2016, 1-6.
 Park, A., Beck, B., Fletche, D., Lam, P. and Tsang, H. (2016) Temporal Analysis of Radical Dark Web Forum Users. Proceedings of the IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM), San Francisco, CA, USA, 880-883.
 Arora, M., Kanjilal, U. and Varshney, D. (2012) An Intelligent Information Retrieval: A Social Network Analysis. International Journal of Web Based Communities, 8, 213-222.
 Wu, P. and Li, S. (2011) Layout Algorithm Suitable for Structural Analysis and Visualization of Social Network. Journal of Software, 22, 2467-2475.
 Chen, H. and Yang, C. (2008) Intelligence and Security Informatics. Vol. 135, Springer, Berlin and Heidelberg, 1-460.
 Yang, C., Mao, W., Zheng, X. and Wang, H. (2013) Intelligent Systems for Security Informatics. Academic Press, Cambridge, Massachusetts, United States, 1-250.
 Jardine, E. (2015) The Dark Web Dilemma: Tor, Anonymity and Online Policing. Centre for International Governance Innovation and Chatham House, 20, 1-24.
 Baravalle, A., Lopez, M.S. and Lee, S.W. (2016) Mining the Dark Web—Drugs and Fake IDs. Proceedings of the 16th IEEE International Conference on Data Mining Workshops, IEEE, Barcelona, 12-15 December 2016, 350-356.
 Zhang, Y., Zeng, S., Huang, C.N., Fan, L., Yu, X., Dang, Y., Larson, C., Denning, D., Roberts, N. and Chen, H. (2010) Developing a Dark Web Collection and Infrastructure for Computational and Social Sciences. Proceedings of the IEEE International Conference on Intelligence and Security Informatics, Vancouver, 23-26 May 2010, 1-6.
 Pellerin, Ch. (2017) DARPA Program Helps to Fight Human Trafficking. Department of Defense, 24 January 2017.
 Sciutto, J. (2015) Interview of Admiral Michael S. Rogers (Responding to a Question Concerning the IC’s Use of the Dark Web). New America Foundation Conference on Cybersecurity, Washington DC, 23 February 2015.
 The Intelligence Advanced Research Projects Activity (IARPA). IARPA Invests in “High-Risk, High-Payoff” Research Programs. IARPA and Office of the Director of National Intelligence.
 Homeland Security News Wire (2015) Cyber Researchers Need to Predict, Not Merely Respond to, Cyberattacks: U.S. Intelligence. Homeland Security News Wire, 9 March 2015.
 The Intelligence Advanced Research Projects Activity (IARPA) (2015) Broad Agency Announcement: Cyber-Attack Automated Unconventional Sensor Environment (CAUSE). IARPA-BAA-15-06, 0-2, 17 July 2015.
 Paganini, P. (2012) What Is the Deep Web? A First Trip into the Abyss. Security Affairs, 24 May 2012.
 Murphy, E.V., Murphy, M.M. and Seitzinger, M.V. (2015) Bitcoin: Questions, Answers, and Analysis of Legal Issues. Congressional Research Service, 1-36, 13 October 2015.
 Androulaki, E., Karame, G.O., Roeschlin, M., Scherer, T. and Capkun, S. (2013) Evaluating User Privacy in Bitcoin. In: Sadeghi, A.R., Ed., Financial Cryptography and Data Security, FC 2013, Lecture Notes in Computer Science, Springer, Berlin, Heidelberg, Vol. 7859, 34-51.