Darknet markets are online services behind Tor where cybercriminals trade illegal goods and stolen datasets. In recent years, security analysts and law enforcement start to investigate the darknet markets to study the cybercriminal networks and predict future incidents. However, vendors in these markets often create multiple accounts (i.e., Sybils), making it challenging to infer the relationships between cybercriminals and identify coordinated crimes. In this thesis, we present a novel approach to link the multiple accounts of the same darknet vendors through photo analytics. The core idea is that darknet vendors often have to take their own product photos to prove the possession of the illegal goods, which can reveal their distinct photography styles. To fingerprint vendors, we construct a series deep neural networks to model the photography styles. We apply transfer learning to the model training, which allows us to accurately fingerprint vendors with a limited number of photos. We evaluate the system using real-world datasets from 3 large darknet markets (7,641 vendors and 197,682 product photos). A ground-truth evaluation shows that the system achieves an accuracy of 97.5%, outperforming existing stylometry-based methods in both accuracy and coverage. In addition, our system identifies previously unknown Sybil accounts within the same markets (23) and across different markets (715 pairs). Further case studies reveal new insights into the coordinated Sybil activities such as price manipulation, buyer scam, and product stocking and reselling. / Master of Science / Taking advantage of the high anonymity of darknet, cybercriminals have set up underground trading websites such as darknet markets for trading illegal goods. To understand the relationships between cybercriminals and identify coordinated activities, it is necessary to identify the multiple accounts hold by the same vendor. Apart from manual investigation, previous studies have proposed methods for linking multiple accounts through analyzing the writing styles hidden in the users' online posts, which face key challenges in similar tasks on darknet markets. In this thesis, we propose a novel approach to link multiple identities within the same darknet market or across different markets by analyzing the product photos. We develop a system where a series of deep neural networks (DNNs) are used with transfer learning to extract distinct features from a vendor's photos automatically. Using real-world datasets from darknet markets, we evaluate the proposed system which shows clear advantages over the writing style based system. Further analysis of the results reported by the proposed system reveal new insights into coordinated activities such as price manipulation, buyer scam and product stocking and reselling for those vendors who hold multiple accounts.

Darknet är en del av den djupa webben, som är en icke indexerad del av internet. Det används för olika ändamål, till exempel att köpa läkemedel och finansiell information. Tillgången till Darknet kan vara anonym genom att använda TOR och Bitcoin. Anonymiteten vid webbsökning under användandet av Darknet kommer påverka bevis för myndigheter. Således kan det ha en möjlig effekt på brottsbekämpande arbete, särskilt angående digitalt kriminaltekniskt arbete, utifrån begränsningen av tillgängliga data. Således syftar denna studie till att fastställa vad de svenska myndigheterna arbetar med för att stoppa illegala aktiviteter som utförs med hjälp av Darknet, i samband med begränsningarna från svensk lagstiftning. Studien kommer att genomföras med hjälp av intervjuer med polis, advokat, köpare och tullen för att få deras insikt och åsikt om det valda ämnet. Medan statistiska uppgifter kommer från undersökningar med kunniga respondenter från forum. På grund av detta kan arbetet fungera som en väsentlig förståelse för hur Darknet kan påverka nutiden och framtida brottsutredningar. Ytterligare arbete måste utföras i området för att lösa potentiella implikationer, eftersom detta arbete endast examinerar om det finns påverkan / Darknet is a part of the Deep web, which an unindexed section of the internet. It is in use forvarious purposes, e.g., buying drugs and financial information. The access to Darknet can besubstantially anonymous by using TOR and bitcoin. Given anonymity for web browsing, it will directly impact evidence about illicit purchases. So, itmay have a possible effect on law enforcement work, particularly on digital forensic work due tothe limitation of data available. Thus, this study aims to determine what the Swedish government isdoing to stop Darknet trading, along with the limitations from Swedish regulations. The focus is thus on criminal prosecution and criminal investigation. The study will be throughconducting interviews with police, lawyer, buyer, and border control to get et their insight andopinion on the chosen topic. Statistical data is from conducting surveys with knowledgeablerespondents from forums. Due to this, the work can serve as an essential understanding of how Darknet may impact presentand future criminal investigations. Additional work must be done in the area to solve the potentialimplications, due to this work only examines if there are any impacts