Chances are you’ve heard of the underbelly of the internet — the darknet. It’s an unfathomable web of nefarious marketplaces where illegal trade in everything from contraband to porn thrives and users are assured watertight anonymity.

This all-important feature of anonymity makes the darknet an attractive place for covert activists and terrorists, and hence subjects it to frequent cyberattacks.

However, the darknet has a formidable line of defence in its unique nodal structure. A recent paper by a Spanish team of researchers published in Physical Review E reveals that the darknet is better equipped to deal with attacks than the internet because of some key attributes — most significantly the decentralised nature — of its network topology. Topology refers to the arrangement of elements like nodes and servers in a network.

Both the darknet and the internet show complicated network topologies, which is not surprising considering the sheer geographical breadth covered by the networks. They don’t adhere to your standard, simple network models, but show a high degree of non-trivial features.

Using publicly available data, the researchers broke down the structure of the darknet network at three independent time instances. The researchers found that not only do the darknet nodes have a higher degree (number of connections per node) but they are also more clustered than in the internet. This, they say, is an important feature in bolstering the darknet’s resilience.

The darknet also has a lesser average path length, a measure of the average number of steps required to communicate between two nodes in a network, than the internet. A shorter path length allows the darknet to have more efficiency in information transport, in turn compensating for delay caused by the more decentralised routing protocols followed.

The ‘rich-club effect’ — or the lack of it

But the most distinctive feature of the darknet is, by far, the lack of the so-called “rich-club effect.” Probably named after a social effect observed among rich people who tend to form exclusive clubs, this rich-club effect, when translated to networks, is essentially the tendency of nodes ‘rich’ in connections to be connected to each other as well.

While the internet displays the rich-club effect for nodes with a high degree of connectivity, the darknet doesn’t. This core of richly connected hubs (nodes with high degrees) in the internet lends a sense of centrality to the network, making it stable and suited for the kind of online services we expect from it today. But, like a double-edged sword, it also makes the internet vulnerable to certain kinds of attacks.

The lack of this rich-club effect in the darknet network topology is an indicator of its decentralised nature and at the same time the primary reason for its resilience.

The researchers used a stochastic model to create networks that mimic how the darknet network looks and behaves. A stochastic model is one that has an element of randomness in how it operates, rather than following a deterministic set of rules. Using the model after testing it against the network topology analysis accumulated from available data, the researchers then tested the network against attacks of certain types — a topological perturbation (targeted or random attack and removal of nodes) and dynamical perturbation (a cascade effect triggered by the removal of a highly connected node).

The internet (and the darknet) adjust well to attacks that are random in nature and are able to restore function without significant damage. But, both the networks are susceptible to targeted attacks — the kind of planned attacks that they might generally encounter.

The darknet, however, is more robust against such attacks when compared to internet, with nearly four times more disruptions required for a major failure. For attacks indicating a cascading failure, networks can be made resilient by enhancing the load-carrying capacity of nodes. The internet needs almost 50% more enhancement in capacity than the darknet to cope with cascading failures and restore near full operation. The darknet can restore full operation with lesser enhancement — a clear marker of the network’s resilience against such attacks.

The paper analyses the topologies of both the internet and the darknet and comes to the conclusion that the darknet topology, owing to its higher clustering and shorter average path length, is characteristically and crucially different from that of the internet. The absence of a core of highly connected high degree nodes, while making data search difficult makes the darknets network decentralised, in turn increasing its strength against attacks and making the network generally more resilient.

The authors do, however, point out that the degree of decentralisation seemed to decrease over the three years they analysed data for (2013-2015) and it would be interesting to carry out a similar analysis for the modern-day darknet — which seems to be evolving like a giant beast, absorbing clandestine activities, and ensuring maximum anonymity to its bidders.

Read other articles on cybersecurity.

---