[00:03.250 --> 00:08.570]  So, as my professor would say, I sabotaged all of this because I was so nervous and I didn't actually want to present.
[00:09.050 --> 00:13.510]  But since I'm here, I will tell you guys all about the research we've been doing.
[00:15.710 --> 00:25.250]  Last year, I went up to my lovely professor, Dominick Foti, who's also my advisor, and I told him that I was sick and tired of not having cyber stuff to work on.
[00:25.510 --> 00:34.630]  The way that Marist does their course load is that cybersecurity students start with a basis in IT, IS, and Comp Sci.
[00:34.870 --> 00:40.010]  So, that meant that I couldn't do any cyber courses until my junior year, specialized or otherwise.
[00:40.470 --> 00:45.030]  So, I approached him one day last year, and I said, please give me something to do.
[00:45.190 --> 00:46.910]  Working on a project on my own is no fun.
[00:47.770 --> 01:01.290]  So, he told me about this Mac malware project that he was working on, and I snoozed a little, and then he said he was doing a project with dark web scraping, and I perked up and I was like, yes, I am totally sold, that is absolutely what I want to work on.
[01:01.450 --> 01:09.790]  So, when he went on further and said that we were scraping information from online marketplaces, I was hooked, as I hope all of you are.
[01:10.530 --> 01:19.450]  When I was younger, I watched a documentary about Ross Albrecht and the Silk Road, and it was world-changing for me.
[01:19.530 --> 01:23.330]  And it was my first introduction to dark web and kind of cyber security practice.
[01:23.690 --> 01:29.950]  So, when I finally got the opportunity to get my hands on the new age of that, I was sold.
[01:31.010 --> 01:32.550]  So, what's our problem?
[01:32.930 --> 01:35.730]  The dark web is full of anonymous users.
[01:35.990 --> 01:40.230]  These people have multiple aliases, and it's really hard to track them.
[01:40.390 --> 01:46.270]  As we know, the dark web is really volatile, and trying to stay on top of things isn't always easy.
[01:46.610 --> 01:56.830]  So, we can't really get a good handle on who these people are, what topics are most important, or how often they're being posted.
[01:59.130 --> 02:10.510]  Our solution focuses on developing a modular tool to scrape text data and create aliases of our own for these people.
[02:11.010 --> 02:17.070]  So, we want to extract... Sorry, one second.
[02:23.890 --> 02:24.530]  Okay.
[02:26.210 --> 02:35.310]  So, the dark web is full of anonymous users that use multiple aliases that make it difficult to find an individual's identity.
[02:35.710 --> 02:45.330]  It's notoriously chaotic, and these different aliases can only be tracked using similar language, post-content, tools, tactics, and procedures.
[02:46.130 --> 02:50.490]  It's really hard to analyze these things by hand.
[02:50.630 --> 02:52.010]  It's almost nearly impossible.
[02:52.230 --> 02:57.450]  So, what we hope to do is to create a scraper that will group these for us.
[03:00.350 --> 03:03.390]  So, I use the word modular and modularity a lot.
[03:03.550 --> 03:08.570]  What this basically means is that in this past year, we've tried to integrate config files.
[03:09.350 --> 03:14.890]  These files aim to create modularity so that there's independent interchangeable parts.
[03:15.070 --> 03:23.270]  To combat the volatility of the dark web, we did this so that we could easily generate a new scraper for each browser.
[03:23.490 --> 03:28.610]  So, when we first started, we used a browser of Firefox, and then we moved on to Tor.
[03:28.830 --> 03:32.750]  And the same can be done with the different websites and forms on the dark web.
[03:33.030 --> 03:36.170]  So, the one that we often use the most is breach forms.
[03:36.770 --> 03:42.070]  But in recent days, months, it's been taken down, put back up, taken down.
[03:42.490 --> 03:46.610]  And the last we know, it was taken down for good by a government agency.
[03:50.750 --> 04:03.430]  So, the modularity helps because the scraper will go in and do it all separately and take all of our HTTP information, HTML.
[04:04.390 --> 04:07.570]  The parser will separate all of the information from that.
[04:08.110 --> 04:12.030]  The data storage is going to put that all into our database.
[04:12.510 --> 04:15.510]  And then our configuration is what's going to bring that all together.
[04:18.270 --> 04:21.030]  So, there are a lot of previous solutions to this problem.
[04:21.270 --> 04:23.950]  On the clear net, there are a lot of scrapers available.
[04:24.270 --> 04:32.490]  For example, you can find a scraper that will go through every grocery store and find the different prices of things so that you can compare them on their own.
[04:33.890 --> 04:37.390]  Those are kind of less of what we're looking at here.
[04:37.810 --> 04:41.650]  So, the problem with those is that they're not open-source.
[04:42.210 --> 04:49.050]  And it's hard to find a scraper, especially for the dark web, that can really combat anti-scraping measures.
[04:49.250 --> 04:51.330]  So, CAPTCHAs and things like that.
[04:51.690 --> 04:57.810]  They're also not the most effective against honeypots, which will sucker you in to take advantage of you.
[04:58.850 --> 05:01.510]  With our tool, we have full control of it.
[05:01.630 --> 05:06.730]  And the modularity makes it easier, as I said before, to change it in the event that anything comes up.
[05:08.530 --> 05:10.690]  So, here is the association of our technologies.
[05:11.190 --> 05:13.130]  I'll go through these side by side.
[05:13.270 --> 05:20.270]  But you see on the side, with breach forms, leak base, black hat world, and hack forms, that those are the forms that we're using.
[05:20.730 --> 05:23.810]  Through those forms, we find them using the Tor browser.
[05:24.690 --> 05:28.610]  We protect ourselves with the mulvad VPN, which is a great VPN.
[05:28.850 --> 05:30.770]  And I will go into that a little bit deeper.
[05:32.170 --> 05:44.010]  That then goes into our remote server, where our scraper is housed, and then feeds information into our database, and front end, and our data analysis and visualization section.
[05:45.050 --> 05:48.610]  So, as I said before, our favorite form is breach forms.
[05:48.850 --> 05:57.930]  We're really lucky where we've partnered with an anonymous cybersecurity expert who works for a very reputable cybersecurity insurance company.
[05:58.210 --> 06:08.090]  Her job is to go and kind of navigate the dark web and interact with malicious threat actors and really assess the situation out there.
[06:08.230 --> 06:13.950]  So, we get a lot of our information about what forms are best for our project from her.
[06:14.790 --> 06:16.350]  That's why we started with breach forms.
[06:16.550 --> 06:22.110]  We have worked a little bit with leak base, but it's also one of those websites that's up and down, up and down, up and down.
[06:22.790 --> 06:30.510]  We haven't explored black hat world and hack forms much, but we're looking to in the future with the volatility of other forms.
[06:32.570 --> 06:35.470]  So, who here knows what the Tor browser is?
[06:37.290 --> 06:39.310]  Okay, so I'm about to make myself sound like an idiot.
[06:40.010 --> 06:44.070]  My professor was nice enough to tell me this was going to be a bunch of college students who didn't know much.
[06:44.250 --> 06:44.850]  Sorry guys.
[06:47.270 --> 06:50.250]  He also taught me the trick to waste time by asking questions.
[06:52.870 --> 06:54.990]  So, the Tor browser.
[06:55.330 --> 06:59.290]  It is enhanced online privacy and anonymity.
[06:59.470 --> 07:05.430]  This is because it routes your traffic through different hops and layers, hence the onion picture on the screen.
[07:06.270 --> 07:07.530]  It's a network of its own.
[07:07.710 --> 07:18.810]  And while you can go on these forms on the ClearNet site sometimes, the dark web option is where you're going to find the most malicious and tasty.
[07:19.030 --> 07:20.170]  I can't think of the right word.
[07:20.750 --> 07:21.270]  Posts.
[07:23.370 --> 07:23.890]  Mulvad.
[07:24.190 --> 07:25.010]  We love Mulvad.
[07:25.910 --> 07:27.350]  Mulvad is a Swedish company.
[07:27.970 --> 07:34.350]  And it was also suggested to us through our anonymous cybersecurity expert who has been helping us out with the project.
[07:34.690 --> 07:38.570]  So, the best part about Mulvad is that you have an anonymous account.
[07:38.850 --> 07:41.890]  They don't log any of your user... you don't have a username.
[07:42.110 --> 07:43.070]  You don't have a password.
[07:43.390 --> 07:45.290]  You don't have any user information.
[07:45.570 --> 07:50.370]  And they also don't log what you're searching for, where you're going, or anything like that.
[07:50.810 --> 07:56.790]  There's an integrated kill switch in it, too, that will stop any network traffic if you need it at any point.
[07:58.270 --> 07:59.370]  It's also in Sweden.
[07:59.590 --> 08:03.810]  So, it's a safer jurisdiction for running a VPN without monitoring you.
[08:04.730 --> 08:15.490]  There's also DNS queries that are encrypted through a tunnel and multi-hop that will, like, kind of help your online browsing be a little bit safer and a little bit harder to track.
[08:16.790 --> 08:21.570]  Our advisor told us that we should always use the same location when we log on.
[08:21.810 --> 08:25.850]  So, I won't tell you guys my go-to, but there's a lot of options you can pick in the U.S.
[08:26.010 --> 08:31.570]  And we just click the same one every time as to not appear kind of like a threat to any network.
[08:33.530 --> 08:33.930]  Okay.
[08:34.170 --> 08:34.970]  So, this is our IDE.
[08:35.810 --> 08:40.670]  We chose this as I... who here knows Visual Studio Code, VS Code?
[08:41.590 --> 08:41.990]  Yeah.
[08:42.270 --> 08:43.310]  It's kind of the go-to.
[08:43.510 --> 08:44.270]  It's the classic.
[08:45.050 --> 08:46.710]  We use it for most of our classes.
[08:46.790 --> 08:51.450]  It has a lot of code that you can... you can use a lot of different libraries.
[08:51.690 --> 08:53.070]  We use Python for a lot of ours.
[08:54.330 --> 08:55.170]  It's the classic.
[08:55.570 --> 08:56.650]  So, that's our go-to.
[08:59.630 --> 09:05.110]  We also... I didn't mention it here, but we also use a virtual machine.
[09:05.610 --> 09:09.630]  And I... the only reason I didn't include it is because we're kind of in between two right now.
[09:09.970 --> 09:11.950]  The one that we were using before is VMware.
[09:12.290 --> 09:18.790]  And I kind of just used that because it was the one I looked up first, and it seemed okay, and I'm not really experienced with virtual machines.
[09:19.830 --> 09:26.210]  But recently, my professor introduced me to Cubes, which is specifically intended for dark web use.
[09:26.470 --> 09:27.590]  So, we've been exploring that.
[09:27.850 --> 09:31.610]  So, if anyone wants to see me after and is like a Cubes expert, that would be great.
[09:33.570 --> 09:34.130]  All right.
[09:34.250 --> 09:34.690]  Technologies.
[09:35.490 --> 09:42.250]  So, our framework technologies rely on a Linux server when we're not working locally, which as college students, we do way too much.
[09:43.530 --> 09:47.590]  We use Python and a lot of the associated Python libraries that you can see beside it.
[09:47.970 --> 09:50.090]  The Tor browser and a MySQL server.
[09:50.250 --> 09:56.470]  That's just one of those servers that we could use easily for our database.
[09:57.310 --> 09:58.230]  Python libraries.
[09:58.570 --> 10:01.510]  Beautiful soup, you can think of as alphabet soup.
[10:01.750 --> 10:12.370]  So, when you go onto a web page, if all of the elements are like the little pasta shapes, beautiful scoop is the ladle that picks that soup up and puts it into your database.
[10:12.550 --> 10:17.790]  So, it can take all of the elements on a page and for your use.
[10:18.450 --> 10:20.610]  So, that's really important, especially in scraping.
[10:20.890 --> 10:23.430]  That's like one of our biggest used things.
[10:23.810 --> 10:24.970]  We also have pandas.
[10:25.190 --> 10:28.470]  Big fan of pandas, both the animal and the library.
[10:30.030 --> 10:34.690]  So, that just kind of helps us to format our data.
[10:34.890 --> 10:39.230]  We usually go with CSV files, but you could do JSON if you wanted.
[10:40.350 --> 10:42.630]  Selenium is what helps us visualize everything.
[10:42.870 --> 10:52.090]  So, I'll show you in our older demo later, but that's kind of what's going to show you the login page and all of the different user profiles.
[10:52.850 --> 11:02.150]  And then date time we use, which will be helpful later down the line when we want to see how many posts there were a day or what user posted on what day to rely back on.
[11:03.770 --> 11:04.330]  All right.
[11:04.430 --> 11:05.710]  So, you can see a little snippet here.
[11:06.570 --> 11:10.490]  So, our data collection process starts with Selenium.
[11:10.850 --> 11:13.810]  So, you're going to use Selenium to visualize our login page.
[11:14.530 --> 11:19.410]  So, you'll open a Tor browser window, navigate to the login page, as you can see, circled in white.
[11:20.390 --> 11:28.750]  The bad part is, and this is the manual part, in addition, after you log in with a username and password, you will have to complete the captcha.
[11:29.110 --> 11:33.810]  That's the one part that we haven't really been able to get around that kind of has been blocking our automation.
[11:36.350 --> 11:37.410]  So, next.
[11:37.950 --> 11:43.130]  Based on the subpages you listed in your config files, so for breach forms, you would go through each of the headers.
[11:44.190 --> 11:45.370]  Each page will be listed.
[11:45.650 --> 11:50.210]  And then the source code for each page will be extracted and then put into our database.
[11:50.970 --> 11:57.130]  With each section of the form, the source code of each author's post will also be extracted and put in a separate place.
[11:57.130 --> 12:03.270]  That way, you can look at the wide scale of every post made that day when you did your scraping.
[12:03.830 --> 12:05.730]  And you can also go in and search by user.
[12:08.590 --> 12:11.570]  So, again, the author will be collected.
[12:11.930 --> 12:15.830]  This will screenshot or take all of the information off of the author's page.
[12:16.030 --> 12:23.690]  That way, you get a little bit more information about them in terms of, like, when they joined, what their ID is, and all of that is saved.
[12:26.190 --> 12:29.930]  So, this is a little bit of a snippet of what it looks like once it's scraped.
[12:30.070 --> 12:33.530]  This is one of our comma-separated files.
[12:34.990 --> 12:40.350]  The information is then collected and the data is stored in an output file, and that's what this will look like.
[12:40.650 --> 12:44.010]  And then it's sent to the database and stored for future analysis.
[12:46.070 --> 12:49.350]  As I mentioned before, this year we switched to configuration files.
[12:49.790 --> 12:53.030]  In the infancy of the project, we weren't really relying on them as much.
[12:53.310 --> 12:54.770]  And we didn't really know much about them.
[12:55.070 --> 13:00.730]  I will say, as a college junior, I don't know if it's normal to know about them, but it was my first exposure to them as well.
[13:00.870 --> 13:03.370]  And I think it's a really amazing thing that code can do.
[13:04.030 --> 13:07.130]  So, this just makes it easy to switch things up.
[13:07.670 --> 13:09.790]  And it makes it easier to build.
[13:09.970 --> 13:18.190]  So, as I mentioned, building from Firefox to Tor, to breach forms, to leak base, we just only have room to evolve from here.
[13:19.310 --> 13:22.390]  And these configuration files are used in the TOML format.
[13:22.670 --> 13:26.290]  The benefit of that is that it's really easy to comment on it.
[13:26.410 --> 13:29.650]  And it's similar to JSON files and things like that.
[13:29.810 --> 13:33.050]  And there's a lot of compatibility with Python libraries.
[13:36.040 --> 13:42.060]  So, what we have so far is that the collected data is stored in the database on the host server.
[13:42.940 --> 13:48.960]  And the scraper can continually run throughout the entire day after you log in and do the CAPTCHA.
[13:49.780 --> 13:54.400]  We're still working and looking to implement more of, like, the next parts of it.
[13:55.280 --> 13:56.760]  So, this is what that will look like.
[13:56.940 --> 14:05.540]  I will say, this demo was done before the integration of config files, just because I wasn't able to record a new one with all of our forms being down.
[14:13.310 --> 14:14.450]  Or... I can't play.
[14:20.620 --> 14:21.060]  Okay.
[14:22.700 --> 14:23.320]  Wi-Fi.
[14:25.320 --> 14:26.180]  I need that.
[14:27.920 --> 14:29.200]  Didn't put that in.
[14:30.900 --> 14:32.760]  So, I can just kind of run it through.
[14:33.560 --> 14:35.800]  Lucky me, I took pictures of everything.
[14:36.020 --> 14:39.020]  It's similar to this, where the first thing you're going to see is this page.
[14:39.340 --> 14:46.420]  And then you can go back and you can see how everyone, except for, like, three people on this entire site has an anime profile picture.
[14:47.460 --> 14:49.060]  And a weird username.
[14:49.440 --> 14:50.540]  But, you know, I don't want to judge.
[14:50.720 --> 14:51.360]  I think it's awesome.
[14:52.080 --> 14:54.080]  Except, like, the criminal activity part of it.
[14:54.220 --> 14:54.680]  Like, I don't know.
[14:56.880 --> 14:58.120]  So, that's what you'll see.
[14:58.240 --> 14:59.640]  You'll filter through all of those.
[14:59.800 --> 15:02.360]  The pages is a little bit... the pages are a little bit bigger.
[15:02.580 --> 15:03.860]  I took little snippets.
[15:05.600 --> 15:11.360]  And then it will go to your output file.
[15:11.820 --> 15:15.600]  And then within that folder, there's another output where it's just by user's name.
[15:15.760 --> 15:19.680]  So, then you can open that file with the user's name and it'll list all of the data.
[15:20.180 --> 15:21.000]  Just from them.
[15:26.630 --> 15:28.270]  So, our biggest roadblocks.
[15:29.030 --> 15:29.510]  Captcha.
[15:29.770 --> 15:30.910]  We don't like Captcha.
[15:31.050 --> 15:32.410]  Captcha is our biggest enemy.
[15:32.950 --> 15:36.370]  It makes it really hard to just let the scraper do its thing.
[15:36.550 --> 15:39.470]  It's not the worst thing to have to do it once a day.
[15:39.770 --> 15:42.590]  Or if your computer closes or whatever, whatnot.
[15:43.870 --> 15:45.550]  But it's not the most ideal.
[15:45.830 --> 15:51.470]  We had one person on our team spend an entire semester on trying to bypass a Captcha.
[15:51.670 --> 15:53.110]  And he was not successful.
[15:54.090 --> 15:56.350]  Enemy number two is the volatility of the dark web.
[15:56.630 --> 15:59.230]  It's so hard to track and expect what's coming.
[15:59.530 --> 16:05.870]  So, it's hard for us to kind of get ahead of it and estimate what's going to happen.
[16:06.530 --> 16:07.950]  So, we just kind of go with the flow.
[16:08.130 --> 16:09.890]  When something goes down, we try something new.
[16:10.090 --> 16:12.090]  And then when that goes down, we try something new.
[16:12.230 --> 16:14.770]  And it's that game for like the rest of our lives.
[16:16.410 --> 16:17.470]  And our new horizon.
[16:17.790 --> 16:18.950]  Our beautiful sunshine.
[16:19.610 --> 16:22.110]  Machine learning, as everybody's always excited to hear.
[16:23.050 --> 16:30.070]  So, we plan to use machine learning and apply it to the data that we have using semantic similarity to analyze that.
[16:30.470 --> 16:34.510]  So, we just want to see the similar language that these people are using.
[16:34.770 --> 16:36.090]  The lexicon.
[16:36.490 --> 16:38.710]  The kind of phrases.
[16:39.150 --> 16:41.730]  You know, there's people who say car different ways.
[16:41.970 --> 16:42.990]  Someone might say automobile.
[16:43.330 --> 16:44.470]  Someone might say chariot.
[16:44.710 --> 16:45.950]  Someone might say car.
[16:46.170 --> 16:46.650]  Vehicle.
[16:47.210 --> 16:49.650]  That's kind of part of the dead giveaway with these.
[16:50.710 --> 16:52.510]  Similar with linguistic profiling.
[16:53.550 --> 16:56.590]  Using sentence structure and things like that to analyze them.
[16:56.590 --> 17:03.570]  And then retrieval augmented generation is kind of leading into our next idea with machine learning.
[17:04.050 --> 17:06.570]  Which is an AI chatbot.
[17:06.970 --> 17:12.370]  So, we really want to use this as the front end of our code for users to play with.
[17:12.710 --> 17:16.310]  That way somebody can go in and say, what were the top five posts made today?
[17:16.570 --> 17:21.730]  When did unicorn fantastic rainbow 63 post last?
[17:22.130 --> 17:23.270]  And things like that.
[17:23.410 --> 17:24.890]  Or what was the biggest topic?
[17:28.040 --> 17:29.400]  And that's all.
[17:30.020 --> 17:31.120]  Any questions?
[17:38.770 --> 17:39.670]  Great job.
[17:40.390 --> 17:43.170]  Wow, Samantha did such an amazing job.
[17:43.830 --> 17:47.890]  I'm going to be fielding questions from the online world.
[17:48.050 --> 17:49.330]  So, just FYI.
[17:55.850 --> 17:57.030]  Any questions?
[17:57.710 --> 17:59.430]  Oh, do I?
[17:59.710 --> 18:00.470]  Go for it.
[18:00.610 --> 18:00.710]  Okay.
[18:01.550 --> 18:02.050]  Orange shirt.
[18:19.290 --> 18:19.690]  Okay.
[18:20.390 --> 18:28.390]  So, he asked if we have tried integrating any of the existing CAPTCHA avoiders or like, you know, to get around them.
[18:28.470 --> 18:29.750]  And if it's a cost issue.
[18:30.030 --> 18:32.730]  To my knowledge, I don't think it's a cost issue.
[18:33.010 --> 18:39.230]  Part of it is because we have been working with a sponsor on this, a company a little bit, which I can't speak to that too much.
[18:39.330 --> 18:46.870]  And I think it might interfere with that a little in terms of like, using a licensed product or something like that in the research that we're doing for them.
[18:47.390 --> 18:50.230]  So, I think they kind of want us to do it on our own for the most part.
[18:51.290 --> 18:53.370]  My professor might be able to add to that a little bit.
[18:54.490 --> 18:55.530]  Oh, he says that's good.
[18:59.440 --> 18:59.980]  Green shirt.
[19:11.890 --> 19:15.290]  I think our next steps are kind of developing it in more of a flushed out way.
[19:15.630 --> 19:20.230]  I was talking with somebody, one of the team members who graduated last night.
[19:20.550 --> 19:30.710]  And the team was previously three seniors and me, and I'm kind of bringing it on with most of the work that they've done, is flushing out what it was truly intended for.
[19:31.010 --> 19:40.890]  The intention of this product was to be able to take dark web forms and output all of these aliases based on how they're speaking, essentially.
[19:41.210 --> 19:46.510]  We want to create aliases of our own to kind of prevent any further anonymity, in a sense.
[19:46.790 --> 19:54.230]  You can go on the dark web and you can have 18 different accounts and pretend to be 18 different people, but there's some things in your language that'll give you away.
[19:54.370 --> 20:04.210]  So, we really want to use machine learning to kind of hone in on that and to complete that part of the project so that we can actually, like, output things to our client.
[20:11.640 --> 20:14.860]  We have a question from the Internet.
[20:15.260 --> 20:19.700]  How much does it cost to run scraping like this?
[20:19.900 --> 20:26.500]  How much time and resources, such as VPN and servers and storage?
[20:27.940 --> 20:44.600]  So, our anonymous sponsor, like, I'm blanking on the word, but like, I'm thinking, like, big, big sibling who's been helping us out with this project did provide the server for us.
[20:44.620 --> 20:45.940]  So, that's to no cost to us.
[20:46.040 --> 20:47.640]  And I wouldn't really be able to answer that fully.
[20:48.140 --> 20:52.280]  In terms of the VPN, the VPN we use, I think, is five euros.
[20:53.780 --> 20:54.560]  It's not bad.
[20:54.680 --> 20:58.880]  And then you pay in either one month or three month increments as you go.
[20:59.800 --> 21:01.900]  For students, it's reasonable.
[21:02.160 --> 21:10.560]  And then you also can use the VPN on, like, five different, like, you can use it on your laptop, your phone, whatever you wanted.
[21:12.720 --> 21:15.360]  So, it's not that high in cost for us, at least.
[21:15.540 --> 21:17.280]  I don't think it is for the school either.
[21:41.900 --> 21:44.860]  So, for those who didn't hear it, he says there isn't a high cost at all.
[21:44.960 --> 21:46.100]  We're still in proof of concept.
[21:46.440 --> 21:48.800]  So, based on what we're running, it wouldn't be too bad.
[21:53.190 --> 21:53.510]  Okay.
[22:01.570 --> 22:01.890]  Yeah.
[22:01.990 --> 22:03.770]  So, we're using an Onion address for these.
[22:04.890 --> 22:05.690]  Oh, sorry.
[22:06.110 --> 22:10.690]  He was asking how we're accessing these Dark Web forms.
[22:10.930 --> 22:19.670]  With Tor, what you can do is, even if you typed in breach forms, it'll also pop up in the corner and it'll tell you that there's a Dark Web, like, Onion address available.
[22:19.950 --> 22:22.130]  And a lot of the times, that's what we do, too.
[22:22.370 --> 22:28.270]  We're not really supposed to bounce around on different, like, hyperlinks on this, especially with us being students.
[22:29.410 --> 22:38.690]  Our sponsor has made us, like, specific accounts for specific websites, where a lot of time and effort goes into maintaining the anonymity behind them and making it safe for us.
[22:38.930 --> 22:42.690]  So, it's very selective what we're allowed to follow.
[22:47.050 --> 22:51.350]  So, LeakBase, Black Hat World, but there's a couple different up and coming ones.
[22:57.590 --> 22:58.110]  Question.
[22:58.630 --> 23:05.110]  You mentioned other scrapers for, like, clear net stores are closed source.
[23:06.290 --> 23:09.790]  Will you be releasing this open-source then?
[23:11.470 --> 23:17.010]  I think that's more of a question for our sponsor and the company that we've been working with a little bit.
[23:17.230 --> 23:23.310]  Because we've been working as research with them as partners, I think it's more in terms of what they want to do with it going forward.
[23:23.570 --> 23:30.150]  I know for me, at least, I will just be working on this for the next two years until it's inevitably my senior capping project.
[23:30.370 --> 23:32.070]  But where it goes after that, I'm not sure.
[23:37.360 --> 23:39.300]  He says we do plan on making it open-source.
[23:52.480 --> 23:55.300]  I've never heard of that before, but I'd love to hear more about it afterwards.
[23:58.080 --> 23:59.040]  Oh, I'm sorry.
[23:59.220 --> 24:00.100]  I'm not used to this.
[24:00.580 --> 24:08.360]  He asked if we would be interested in using any commercially licensed dark web scraping forms, right?
[24:08.360 --> 24:08.940]  No.
[24:26.100 --> 24:26.700]  Wow.
[24:27.140 --> 24:30.200]  So it's a database of already scraped dark web forms?
[24:30.920 --> 24:32.080]  Everything on the dark web?
[24:32.220 --> 24:32.460]  Okay.
[24:33.120 --> 24:33.580]  Wow.
[24:33.980 --> 24:35.200]  It's called DarkOwl?
[24:35.400 --> 24:36.000]  DarkOwl.
[24:36.040 --> 24:36.520]  DarkOwl.
[24:38.040 --> 24:38.160]  Oh.
[24:38.640 --> 24:40.020]  I don't like that sound.
[24:42.960 --> 24:43.560]  Not me.
[24:43.840 --> 24:44.760]  I don't have that.
[24:44.820 --> 24:45.560]  I'm a college student.
[24:51.240 --> 24:57.680]  Are there any difficulties with using cubes with your software as opposed to another VM?
[24:59.040 --> 25:07.860]  So truthfully, I haven't explored cubes that much only because I don't really want to do any of this dark web stuff on my school laptop.
[25:08.180 --> 25:11.860]  I have an extra laptop that's like an old Microsoft Surface that I used in high school.
[25:12.020 --> 25:13.240]  And I've been doing it on that.
[25:13.320 --> 25:17.740]  And it's just like not a big enough computer to run things properly on it.
[25:17.860 --> 25:19.500]  So that's been kind of part of the hangup.
[25:19.680 --> 25:23.960]  I would like to explore it more, but I kind of have to do a different set up too.
[25:28.260 --> 25:28.660]  Yes.
[25:29.780 --> 25:31.140]  I'm like raising my hand back at you.
[25:43.020 --> 25:47.400]  No, but we would like to explore large language models in terms of that.
[25:47.480 --> 25:51.080]  And if we can apply something that's already been made, we would like to.
[25:51.300 --> 25:56.260]  But if it doesn't really fit what we're going for, we are open to making our own.
[26:07.030 --> 26:17.670]  Regarding the ML you just spoke of, will this resolve issues of people on the dark web switching aliases to try to remain hidden?
[26:20.970 --> 26:26.930]  So when people on the dark web lose their accounts, they lose a lot of the credibility they've built with it.
[26:27.110 --> 26:29.150]  With forms like this, they're selling things.
[26:29.410 --> 26:31.370]  And some of that credibility is necessary.
[26:31.630 --> 26:33.590]  So there's two types of people.
[26:33.750 --> 26:36.210]  There's a person who wants that credibility because they're selling things.
[26:36.310 --> 26:43.770]  And there's another type of person out of many different options, who has 18 different accounts across the Web.
[26:44.050 --> 26:49.030]  And they can use these 18 different accounts to make fake credibility or do other things.
[26:49.190 --> 26:53.090]  But if they're using the same language, it will hopefully cut down on that.
[26:53.250 --> 27:00.870]  So if And if there's an instance where somebody is scamming other people using multiple different accounts, this will helpfully be the solution to that.
[27:01.190 --> 27:04.190]  They could always get around it by talking like totally different people.
[27:04.450 --> 27:13.590]  If I put what I was going to say into an AI model and said, hey, make this sound like a sixth grader wrote it, it's going to mess us up a little bit.
[27:14.050 --> 27:16.970]  But it's a start to a solution.
[27:21.360 --> 27:22.840]  Oh, Green Cherry.
[27:41.720 --> 27:48.460]  So he asked if we are going to integrate threat intelligence and APTs, right?
[27:48.700 --> 27:49.140]  I get that right?
[27:50.440 --> 27:51.420]  And thank you.
[27:52.780 --> 27:58.080]  Truthfully, not that I know of, but we are looking to better this project in any way possible.
[27:58.080 --> 28:01.300]  And if you have ideas for that, I would love to hear about them afterwards.
[28:02.020 --> 28:04.900]  But to my knowledge, we haven't really worked on anything like that.
[28:06.820 --> 28:07.220]  Yes.
[28:16.330 --> 28:18.530]  To my knowledge, it might be used for investigation.
[28:21.800 --> 28:26.240]  Okay, so it is a cybersecurity insurance that we are kind of being sponsored by.
[28:26.440 --> 28:28.860]  So I think it's more so for investigations for that.
[28:29.060 --> 28:32.860]  And it's also going to be used to how they can better protect their clients in a way.
[28:35.680 --> 28:37.460]  Sorry, I'm really bad about repeating the questions.
[28:37.740 --> 28:41.400]  It was how we were going to use the data going forward.
[28:41.960 --> 28:43.480]  And if it was, yeah.
[28:46.920 --> 28:50.120]  Have you looked into the I2P network?
[28:51.980 --> 28:54.200]  I have never heard of that before.
[28:54.720 --> 28:55.880]  But I will.
[28:56.100 --> 28:56.680]  I2P.
[28:56.900 --> 28:57.580]  Write that down.
[29:02.960 --> 29:04.860]  This one looks really good.
[29:05.240 --> 29:13.920]  What about other solutions such as shared PGP keys across accounts and signed PGP keys from other handles?
[29:22.330 --> 29:24.170]  Truthfully, I'm not sure how to answer that.
[29:27.290 --> 29:28.390]  Shared PGP keys?
[29:31.210 --> 29:33.750]  My professor says we have not looked into that yet.
[29:36.370 --> 29:36.790]  Yes.
[29:47.210 --> 29:50.930]  Last night, have I looked at the data myself and what's the most interesting thing I've seen?
[29:51.630 --> 29:54.550]  I guess it wasn't really what I was expecting when I looked at it.
[29:54.710 --> 29:58.650]  Because I think, like, media plays up the dark web to be so scary.
[29:59.010 --> 30:03.270]  And like, oh, there, which there's really, there's really bad things on there.
[30:03.430 --> 30:04.110]  Don't get me wrong.
[30:04.290 --> 30:08.070]  But my school is nice enough to, like, not expose me to that that much.
[30:08.170 --> 30:09.790]  So it's mostly like, hey, tools.
[30:10.110 --> 30:12.490]  Hey, 200 stolen government emails.
[30:14.430 --> 30:16.270]  Citizenship information for Romania.
[30:17.070 --> 30:18.770]  That was the one we saw last night.
[30:18.910 --> 30:23.290]  I was talking with the senior who just graduated on our project, and he told me to shout out Romania.
[30:23.950 --> 30:24.690]  So, yeah.
[30:25.470 --> 30:29.850]  Some interesting stuff, but, like, not quite as interesting as you would expect.
[30:34.200 --> 30:35.760]  Oh, back there in the black shirt.
[30:47.550 --> 30:54.510]  Truthfully, I would, oh, if there's anything that we can do to evade linguistic profiling, to my knowledge.
[30:56.270 --> 30:57.990]  Not that I've thought of yet.
[30:58.170 --> 30:59.410]  Not that I've researched enough.
[30:59.630 --> 31:01.170]  There probably are other ways.
[31:01.370 --> 31:05.250]  That's, like, the one that a lot of people, I think, would initially resort to.
[31:06.790 --> 31:09.470]  But, I mean, when it's language-based, it's kind of hard to do that.
[31:09.910 --> 31:16.550]  If you, if you were, like, writing and, like, pick Latin or something, like, it's going to be a dead giveaway.
[31:16.810 --> 31:19.650]  But, like, you could be totally different across all the board.
[31:22.310 --> 31:22.970]  In the red shirt.
[31:24.550 --> 31:24.870]  Yes.
[31:35.470 --> 31:40.250]  If I, the question is if I'm worried that I'm violating the terms and conditions.
[31:41.290 --> 31:48.490]  I think that that's the beauty of the dark web, is that we just don't listen to rules or anything.
[31:49.070 --> 31:49.750]  So, no.
[31:50.030 --> 31:50.730]  No, we're not.
[31:51.590 --> 31:54.710]  Knock on wood, unless that's, like, someone's going to send me to jail.
[31:57.870 --> 31:58.570]  Green shirt.
[32:29.480 --> 32:32.240]  Can you expand a little bit more on what you mean by abuse?
[32:42.430 --> 32:42.790]  Hmm.
[32:46.860 --> 32:47.180]  Okay.
[32:47.640 --> 32:57.440]  So, the question was, if I can summarize, like, how could this project go wrong, de-anonymizing people.
[32:59.200 --> 33:00.820]  Truthfully, we haven't thought of it that much.
[33:00.960 --> 33:05.680]  And that's a really good idea, especially on the ethics side of this, because that's something to keep in mind when doing part of the work.
[33:05.680 --> 33:08.720]  I think there's a lot of projects like this that we haven't looked into that much.
[33:09.000 --> 33:21.360]  I think Tor is already really good if you're in an authoritarian area, going online, where it's going to let you look up for, like, different websites that are probably going to be blocked.
[33:21.840 --> 33:26.340]  So, I can understand how a lot of people in that situation would already be on there searching things.
[33:26.920 --> 33:37.900]  I think that if they were just going about normal things, or I don't want to say normal, but day-to-day life on Tor to just get on to blocked websites, that's one thing.
[33:37.900 --> 33:50.020]  But being on this form and actively listing things, I think if that's what's giving them away, then that's something that they already have to keep in mind, because they might get raided by the government and tracked down that way, too.
[34:02.070 --> 34:03.310]  He says, up your game.
[34:05.830 --> 34:07.530]  The flannel, I think, or plaid.
[34:07.850 --> 34:08.110]  I don't know.
[34:14.420 --> 34:23.940]  Truthfully, we aren't running it for that long when we usually do this, just because we've been working a lot on fine-tuning things and legitimately making it work.
[34:25.200 --> 34:28.400]  We haven't been running it and running it and running it to get that data.
[34:28.880 --> 34:30.960]  Right now, the data isn't the most important thing.
[34:31.440 --> 34:36.380]  Once we have kind of something that can analyze the data, then it's definitely going to come into play.
[34:36.540 --> 34:38.540]  But right now, not that much.
[34:41.680 --> 34:42.340]  Orange shirt.
[35:02.980 --> 35:10.820]  So, I think, in my opinion, to my knowledge, it's less about us using the data and more about the company sponsoring us using it.
[35:10.820 --> 35:15.240]  Because they are an insurance company, their main goal is probably to look out for their clients.
[35:15.520 --> 35:23.400]  So, like, if they're going through that, and the person who's been advising us, her main goal is to go through the web and find these things on their own.
[35:23.580 --> 35:25.740]  So, they have no problem doing this.
[35:25.760 --> 35:28.200]  And they fully intend to use it to its full extent.
[35:28.200 --> 35:32.260]  I think more so to protect those people and then capitalize on it.
[35:34.660 --> 35:35.560]  Anything I should add?
[35:37.780 --> 35:38.180]  Okay.
[35:38.180 --> 35:40.200]  I think that's the full extent of it.
[35:40.860 --> 35:42.600]  We won't really be doing much.
[35:42.800 --> 35:48.800]  Like, it's not really like we're going through and we're seeing social security numbers and being like, Ooh, I'm going to take a new loan out.
[35:49.580 --> 35:52.020]  If somebody did that, they would get into a lot of trouble.
[35:52.860 --> 35:53.260]  Right?
[36:34.100 --> 36:34.860]  Last question.
[36:36.140 --> 36:36.540]  Back.
[36:36.760 --> 36:37.120]  Black shirt.
[36:43.240 --> 36:44.800]  Truthfully, we haven't gotten that far.
[36:44.940 --> 36:49.260]  But the machine learning aspect of it would realistically be how we would verify.
[36:49.260 --> 36:55.020]  So like, say, you mean in terms of like an alias on our end or a profile?
[36:55.280 --> 36:56.620]  Oh, I should repeat the question too.
[36:56.820 --> 36:58.520]  But can you expand on your question a little bit?
[36:58.840 --> 36:59.280]  Yeah.
[37:02.920 --> 37:03.440]  Mm-hmm.
[37:12.810 --> 37:13.250]  Okay.
[37:13.330 --> 37:18.550]  So the question is how we are going to verify that they're the same people across forms and in general.
[37:19.370 --> 37:24.190]  Truthfully, you can only do so much to our knowledge with the research that we've done so far.
[37:24.190 --> 37:31.630]  There is the chance that like, say you have a brother and sister or something like that, that are on the dark web, and they talk exactly the same.
[37:31.810 --> 37:35.350]  They grew up in the same household, they have similar language, and they're both on there.
[37:35.610 --> 37:42.290]  There's a chance that the statistics of it, they might be grouped into the same because they have X amount of similarity.
[37:42.290 --> 37:47.310]  So it's not a foolproof solution, but it gets you close enough to have an idea.
[37:49.070 --> 37:49.950]  If that...yeah.
[38:40.990 --> 38:44.610]  So the summary of that is we're using it in specific use cases.
[38:46.570 --> 38:47.550]  I think that's all.
[38:47.710 --> 38:48.570]  That's all the time we have.
[38:48.770 --> 38:50.770]  Thank you all for listening and being so kind to me.
[38:51.110 --> 38:51.570]  Thank you.