ES2719123B2 - PROCEDURE AND SYSTEM FOR THE CLASSIFICATION AND DETECTION OF THE MOST INFLUENTIAL DOMAINS WITHIN THE DARK TOR NETWORK - Google Patents

Description

DESCRIPTION

PROCEDURE AND SYSTEM FOR THE CLASSIFICATION AND DETECTION OF THE

MOST INFLUENTIAL DOMAINS WITHIN THE DARK TOR NETWORK

OBJECT OF THE INVENTION

The object of the present invention is an automated procedure and system to classify and detect the most influential domains within the Tor darknet (The Onion Router) based on the hyperlinks they contain. The invention makes it possible to identify which domain is the most influential within the network, that is, the domain whose removal would cause the greatest destabilization of the network. Said destabilization would affect a very high reduction or obstruction in the transmission of information through the different domains. This invention also makes it possible to identify the categories of the different domains analyzed, and to identify the most influential domain by category.

BACKGROUND OF THE INVENTION

Currently, the way to access information on the Internet is through the use of search engines, such as Google or Bing. Although they are efficient and very powerful, they cannot index all the content on the web. The content that is indexed belongs to the Surface Web, and the rest of the content, which is not indexed, belongs to the Deep Web. Within the Deep Web, there is a part made up of several networks and is called the Dark Network, with Tor (The Onion Router) being the most famous dark network, due to the level of anonymity it provides to its users.

Due to the Tor topology and the fact that it is not possible to record domain traffic, it is not possible to establish a measure of the popularity or influence of such domains within the network. Furthermore, given the anonymity it provides, the Tor darknet hosts domains with different content, both legal and illegal. As a result of illegal content on Tor, the need arises to classify said content in different types of illegal activities and identify which domains are the most influential within the network, both globally and for each category. The elimination of the most influential domains would destabilize the network and make it difficult to transmit information through the different domains.

Manual classification of domains has a number of drawbacks. In the first place, due to the high number of possible domains, of the order of tens of thousands, it requires a high investment of time and personnel to carry out the classification. In addition, the classification depends to a great extent on the person who performs it, providing subjectivity that generates a disparity of criteria among experts. Also, the domain classification is not always reliable, since errors frequently occur due to fatigue and lack of expert attention. Finally, it is an expensive process due to the high costs associated with the time of the person who performs the classification.

Due to the previous characteristics of the dark network Tor, it would only be possible to use the textual content of your domains to measure their influence, since certain visual content would be illegal according to Spanish regulations, such as child pornography. Bearing this limitation in mind, the analysis of the relevance of the domains based on graph theory is used, where the domains will be the nodes and the hyperlinks between them the links. According to various studies (K. Taha and P. Yoo, “Using the Spanning Tree of a Criminal Network for Identifying Its Leaders”, IEEE Transactions on Information Forensics and Security, vol. 12, no. 2, pp. 445-453, 2017 ), in order to destabilize a network it is necessary to eliminate the most influential nodes of the graph, in order to achieve a significant reduction in the flow of information through the graph.

The measurement of the influence or relevance of nodes within a graph began to be used more than 60 years ago. Initially, we worked with measures of centrality (Bavelas, A. (1948). «A mathematical model for group structures». Human Organization 7: 16-30.), Which over time evolved to more complex algorithms, such as Katz (Katz , L. (1953). A New Status Index Derived from Sociometric Analysis. Psychometrika, 39-43.), HIST (Jon M. Kleinberg. 1999. Hubs, authorities, and communities. ACM Comput. Surv. 31, 4es, Article 5, December 1999) or PageRank (US6285999B1, 1997).

Although the previous influence measurement algorithms achieve acceptable results when destabilizing a network, a method and a system for the classification and subsequent detection of the most influential domains in the Tor dark network has not been specifically described.

DESCRIPTION OF THE INVENTION

The object of the present invention is an automated procedure and system to classify and detect the most influential domains within the Tor darknet (The Onion Router) in depending on the hyperlinks that exist between them. Hyperlinks are, therefore, specific to domains.

The procedure and system for the classification and detection of the most influential domains within the Tor dark network (The Onion Router) of the present invention allows to automatically classify and order large repositories of domains obtained through digital technology (computer) with internet access, and connected to the Tor network to collect textual information.

Automatic classification, as an intermediate step to the detection of influential domains, compared to manual by an expert, cancels subjectivity, errors due to fatigue and inattention, the disparity of criteria between experts, the costs associated with the expert's time, decreases the time required for sorting and increases the reliability of labeling. For this reason, this procedure can be implemented in tools used by companies and FFCCSSEE (State Security Forces and Bodies) to classify the Tor darknet domains into different categories, and their subsequent detection of the most influential domains both within the Tor network and in each selected illegal category.

The present invention can also be applied in the training or distance learning of specialized personnel in the different categories considered illegal. The provision of large sets of already classified domains and the current possibilities to collect new domains and send them to a system remotely, would allow FFCCSSEE or company personnel to improve their knowledge about the different illegal categories present in the Tor darknet, thus that would increase their knowledge when it comes to differentiating them from other legal categories present in said network.

Within the process prior to the procedure of the invention, the system would allow the automatic classification of domains by means of text encoding through the Frequency of Terms - Inverse Document Frequency (TF-IDF, “Term Frequency -Inverse Document Frequency), metric that indicates the relevance of a word in a document, and its subsequent classification with Logistic Regression (LR, “Logistic Regression”). The classified domains fall into the following categories: (i) pornography, (ii) cryptocurrency, (iii) credit card smuggling, (iv) sale of illegal drugs, (v) violent activities, (vi) cyber attacks (hacking) , (vii) counterfeiting of currency, (viii) smuggling of personal identification and (ix) others.

Next, the procedure of the invention makes it possible to measure the influence of illegal domains both (i) at the global level and (ii) at the level of each of the previous categories. For this, a Graph of Interesting Activities is constructed, where each domain is represented by a node, and the links in the graph come from the different incoming and outgoing hyperlinks contained in the previous domains. Therefore, the links are specific to the nodes and there are as many incoming links to the node as there are hyperlinks pointing to it and as many outgoing links from the node as it points to other hyperlinks. In this process, duplicate links are eliminated, that is, those that have the same origin and destination, to avoid creating multigraphs, and also those links to the Superficial Web. Next, the algorithm is applied to identify which are the most influential domains within the entire network, and also for each category, whose elimination would affect the flow of information within the network.

In a preferred embodiment of the invention, this procedure is applied to illegal domains of the Tor network, both globally and by different categories, although it can be applied without categorizing illegal activities. It can also be extended to legal domains on the same network, to its application on the Superficial Web, to contact networks and, in general, to any type of network where there are incoming and outgoing links between its different elements.

In the present description, before coding the text for later classification, it is pre-processed. After a scan of all Tor domains, the resources of those that are active are downloaded and their HTML file is extracted. Then those domains that are in English are selected and HTML tags, special characters, and stopwords are removed. In the present invention, the term "raw text" refers to that which is contained in the domain's HTML and where no preprocessing has been applied. On the other hand, the term "text" is generally used to refer to the resulting text after preprocessing the "raw text" according to the previous description.

The preferable procedure for the classification and subsequent detection of the most influential illegal domains within the Tor darknet of the present invention comprises the following steps:

1. Domain tracking and raw text download. From a public list of domains on the Tor network, these domains are tracked and, for each domain that is active at the time of the crawl, its HTML file is downloaded, which contains the raw text. This domain tracking and downloading is done through a computer with an internet connection and the Tor darknet.

2. Raw text preprocessing: within the same computer, for each HTML file obtained, the raw text content is preprocessed to obtain the text. Next, and in accordance with a preferred embodiment of the invention, through a language detection library those domains that are in English are selected, in order to improve the subsequent training of the classification system, as English is the language mostly used on the Tor network. In a preferred embodiment, the HTML language tags, special characters and stop words are removed, resulting in the final text.

3. Text classification: according to a preferred embodiment of the invention, an automatic text classification process is carried out, in order to be able to identify which will be the most influential domains of the Tor dark network within each of the categories. of illegal activities it contains. In a preferred embodiment, the text is encoded with the Term Frequency - Inverse Document Frequency (TF-IDF) and the domains with Logistic Regression (LR, "Logistic Regression") are classified into the following categories: (i) pornography, (ii) cryptocurrency, (iii) credit card smuggling, (iv) sale of illegal drugs, (v) violent activities, (vi) cyber attacks (hacking), (vii) counterfeiting of currency, (viii) contraband of personal identification and (ix) others. According to a preferred embodiment of the invention, a minimum vector length of three and a maximum of 10,000 elements is used for the Frequency of Terms - Inverse Document Frequency, and for the classification with Logistic Regression, the weight balance between classes was activated. .

4. Construction of the Interesting Activities Graph: once we have the text ready, the Interesting Activities Graph is constructed for all the domains of the Tor network. In a preferred embodiment of the invention, the Interesting Activity Graphs corresponding to the domains classified in the nine categories previously indicated are also constructed. In said preferred embodiment, each domain is associated with the nodes of the graph and the links between the different nodes are established based on the hyperlinks incoming and outgoing for each domain. In the preferred embodiment, duplicate hyperlinks, that is, those with the same origin and destination, are eliminated.

Cálculo de dominios más influyentes con algoritmo de influencia. Por último, se procede al cálculo de los dominios más influyentes de la red oscura Tor. De acuerdo con una realización preferente de la invención, también se calculan los dominios más influyentes de las diferentes categorías ilegales la red oscura Tor para los que se generaron los anteriores Grafos de Actividades de Interés. Dicho cálculo se lleva a cabo en dos fases. En una primera fase, se aplica el algoritmo de influencia, el algoritmo de medida de la influencia de dominios para calcular el ranking de los diferentes dominios extraídos de la red Tor. El valor de rango de un dominio se obtiene como la combinación ponderada de la suma del número de hipervínculos de los dominios seguidores y seguidos del dominio analizado. Según varios estudios, la desestabilización de una red se consigue eliminando los nodos con un mayor ranking, lo que da lugar a una obstrucción en el flujo de la información a través del grafo. De acuerdo con una realización preferente de la invención, se interpreta la influencia dentro de la red oscura Tor como la cantidad de obstrucción que un nodo puede causar al Grafo de Actividades Interesantes cuando es eliminado. En una segunda fase, se realiza una ordenación descendente de dichos dominios según el valor de rango obtenido, siendo los primeros dominios los de mayor valor y por lo tanto considerados los más influyentes.5.

Calculation of most influential domains with influence algorithm. Finally, the most influential domains of the Tor darknet are calculated. According to a preferred embodiment of the invention, the most influential domains of the different illegal categories are also calculated in the Tor darknet for which the previous Activity of Interest Graphs were generated. This calculation is carried out in two phases. In a first phase, the influence algorithm is applied, the algorithm for measuring the influence of domains to calculate the ranking of the different domains extracted from the Tor network. The rank value of a domain is obtained as the weighted combination of the sum of the number of hyperlinks of the following and followed domains of the analyzed domain. According to several studies, the destabilization of a network is achieved by eliminating the nodes with a higher ranking, which leads to an obstruction in the flow of information through the graph. According to a preferred embodiment of the invention, the influence within the Tor dark network is interpreted as the amount of obstruction that a node can cause to the Interesting Activity Graph when it is removed. In a second phase, said domains are sorted in descending order according to the rank value obtained, with the first domains being those with the highest value and therefore considered the most influential.

A second aspect of the present invention relates to a system for the classification and subsequent detection of the most influential illegal domains within the Tor darknet from domains recovered from the Tor darknet. The system comprises data processing means, such as a computer with an internet connection, configured to track and download raw text or HTML from domains on the Tor network; preprocessing the raw text to get text ready for analysis; perform an automatic classification (optional) of said domains by Frequency of Terms - Inverse Document Frequency and Logistic Regression; generate a Graph of Activities of Interest, with the nodes being the domains and the links being the hyperlinks between the different domains; apply the influence algorithm to obtain the most influential domains within the Tor network, being those that obtain the highest value from the algorithm.

In a preferred embodiment of the invention, the system comprises a computer connected to the internet and with configured access to the dark network Tor. The system may also comprise a data storage means where HTML files or text are stored in raw, files containing the preprocessed text, the categories of the domains, the Graphs of Activities of Interest and the ordering of the domains of the Tor network ordered according to the rank value.

Finally, the present invention also relates to a program product comprising program instruction means for carrying out the above-described procedure when the program is executed on a processor. The program product is preferably stored on a program support medium. The program instruction means may be in the form of source code, object code, an intermediate source of code, and object code, for example, as partially compiled form, or in any other form suitable for use in implementing the processes according to the invention.

The program support medium can be any entity or device capable of supporting the program. For example, the medium could include a storage medium, such as ROM memory, CD ROM or semiconductor ROM, flash memory, magnetic recording medium, for example hard disk or solid state memory. (SSD, solid-state drive). Furthermore, the program instruction means stored on the program carrier may be, for example, by an electrical or optical signal which could be carried via electrical or optical cable, by radio or by any other means.

When the program product is incorporated into a signal that can be carried directly by a cable or other device or medium, the program carrier can be constituted by said cable or other device or medium.

As a variant, the program support can be an integrated circuit in which the program product is included, the integrated circuit being adapted to execute, or to be used in the execution of the corresponding processes.

BRIEF DESCRIPTION OF THE DRAWINGS

Next, a series of figures are very briefly described that help to better understand the invention and that expressly relate to an embodiment of said invention that is presented as a non-limiting example thereof.

Fig. 1 shows a simplified diagram of a system capable of carrying out the process of the invention.

Fig. 2 shows an example of HTML content or raw text from a Tor darknet domain.

Fig. 3 shows an example of the resulting text after preprocessing the Tor darknet domain presented in Fig. 2.

Fig. 4 shows the Graph of Activities of Interest for all the illegal domains of the Tor network.

Fig. 5 shows the Graph of Activities of Interest for the domains belonging to any of the previously mentioned categories, among them “smuggling of credit cards” and “sale of drugs” from the Tor network.

Fig. 6 shows the output of the data file that would contain the domains of the Tor darknet ordered according to the rank value, indicating the influence within said darknet.

PREFERRED EMBODIMENT OF THE INVENTION

An example of a method according to the invention is described below with reference to the attached figures. Figure 1 shows a simplified scheme of the most influential domain detection, classification and tracking system. All of this could be implemented on a computer 2 (which could be any desktop or laptop computer with a core, 512MB of RAM and 8Gb of hard disk). Computer 2 connects to the internet and is configured to be able to access the Tor 1 dark network. Next, a domain search is performed 3 and those that are active in their raw text are downloaded 3, obtaining a text HTML file 4 On this file a preprocessing of the raw text 5 is carried out to obtain the final text 6 on which to work. In the example of the method according to the invention, an automatic classification of the text 6a is also carried out, resulting in a series of labels corresponding to the different categories of the analyzed domains 6b. From the preprocessed text 6, an extraction of the hyperlinks is performed incoming and outgoing of each domain and a Graph of Activities of Interest 8 is constructed for the entire Tor darknet. Additionally, in this example of the method according to the invention, a Graph of Activities of Interest is constructed for each of the resulting categories after the automatic classification process. Finally, the influence algorithm 9 is applied, resulting in a data file 10 where the Tor domains appear ordered according to their rank value. The domains located in the first position are considered the most influential of the network. Additionally, in this example of the method according to the invention, a data file is generated for each of the resulting categories after the automatic classification process, where the domains that belong to the same category appear ordered by their rank value. Next, each step of the process of the invention is described.

The connection of the computer 2 to the internet can be done via a wireless connection or via an Ethernet network cable. The connection of the computer 2 to the dark web Tor 1 comprises a process of installation of a special software that allows to connect to said dark web, as for example the installation of the browser Tor, “Tor Browser”. The purpose of this connection and configuration is to obtain the raw text necessary to carry out the automatic classification and subsequent calculation of the most influential domains.

This is followed by domain crawling and raw text download. First, you get a public list of domains from the Tor darknet, which could be obtained from the Surface Web. Given the life cycle of domains on the Tor network, no links are provided in this document. This list of domains is read by the tracking program and the raw text 3 of those domains that are active is downloaded, thus obtaining an HTML file per active domain analyzed.

Figure 2 shows an example of HTML or raw text content from a Tor darknet domain. As can be seen, there are many non-natural language textual resources, such as HTML programming language tags, that must be removed before continuing with the procedure and thus achieve greater precision in the classification.

In the next stage, the raw text contained in the HTML files retrieved from the Tor darknet is preprocessed. First, the HTML language tags are removed and, in the case of tags that reference images, the

one

extension and the image name is left. Next, those domains whose language is English are selected, since it is the dominant language of the Tor network, although it could be done with other languages. In this preferred embodiment of the invention, said selection is made with the Langdetect library (https://pypi.python.org/pypi/langdetect). Finally, special characters and stopwords are eliminated through the SMART stopword list (http://www.ai.mit.edu/projects/jmlr/papers/volume5/lewis04a/a11-smart-stop-list/) . Due to the scope of work, that is, the Tor darknet, this list is modified and 100 new words are added to improve compatibility. Finally, all emails, web addresses and currencies are unified in a single textual resource. Figure 3 shows an example of the resulting text after preprocessing the Tor darknet domain presented in Figure 2 .

After the preprocessing of the raw text, the domains are automatically classified, in order to be able to calculate which are the most relevant domains within each category, and not only identify them at the level of the entire Tor dark web. The already processed text is preferably encoded by TF-IDF (Akiko Aizawa. 2003. An information-theoretic perspective of tf-idf measures. Information Processing & Management, 39 (1): 45-65.), Using a minimum vector length of three and maximum of 10,000 elements. Next, the system is trained with LR (David W. Hosmer Jr. and Stanley Lemeshow. 2004. Applied logistic regression. John Wiley & Sons), activating the balance of weights between classes. The resulting categories are: (i) pornography, (ii) cryptocurrency, (iii) credit card smuggling, (iv) sale of illegal drugs, (v) violent activities, (vi) cyber attacks (hacking), (vii) counterfeiting of currency, (viii) contraband of personal identification and (ix) others.

Once the preprocessing of the raw text and the domain classification have been completed, the Graphs of Activities of Interest are constructed. Initially, the incoming and outgoing hyperlinks belonging to the HTTP and HTTPS protocols are extracted for each domain. During this process, the hyperlinks are eliminated, and therefore duplicate links from the graph, that is, those that have the same origin and destination, to avoid the creation of multigraphs, and also those hyperlinks that point to the Superficial Web. Next, the Graph of Activities of Interest is constructed, where the nodes correspond to domains, and the links to the different incoming and outgoing hyperlinks contained in the previous domains. A link is generated between two nodes A and B as long as domain A refers to domain B, or vice versa, at least once.

Figure 4 shows a general view of the Graph of Activities of Interest for all the domains considered in the Tor network.

Figure 5 shows a more detailed view of the Graph of Activities of Interest, where you can see how the nodes that represent each domain are categorized and the multiple links between them.

Finally, the calculation of the influence of the list of domains is carried out for all the analyzed domains of the Tor dark network as well as for the domains within the following categories (i) pornography 11, (ii) cryptocurrency 12, (iii) smuggling of credit cards 13, (iv) sale of illegal drugs 14, (v) violent activities 15, (vi) cyber attacks 16 (hacking), (vii) counterfeiting of currency 17, (viii) smuggling of personal identification 18. Do not know includes the category others since it encompasses activities of multiple types and a list of domains is already being calculated for the entire network, which is considered not to contribute to providing a relevant list of domains.

This measure of influence is based on the calculation of the rank value associated with each domain and the subsequent descending ordering of said domains according to the rank value obtained, with the first domains being those with the highest value and, therefore, those considered as most influential. The influence algorithm identifies the most central node in a graph by measuring the number of nodes to which traffic can propagate and the number of nodes from which it receives traffic. The calculation of the range value consists of two phases, an initialization phase and a weight update phase. Given a Graph of Activities of Interest that contains N nodes and E links, the algorithm is initialized by assigning an initial weight In to each node n, using the following formula:

Wn = Di D0 (1)

where Di is the value of the input degree and D0 is the value of the output degree respectively. The value Di is related to the number of incoming links from a node and the value D0 represents the number of outgoing links from that node.

Next, each node n is assigned the cumulative weight of its followers, which are the nodes that are pointing to node n , and the weight of the nodes that node n follows. The rank value (R) is assigned to node n taking into account the initial weight Wn assigned (1) according to the following formula:

Rn = Wn log ( aW F pwf) (2)

where WF is the accumulated weight of the followers and Wf is the accumulated weight of the nodes that n follows. The parameters a , control the contribution of the weights of the followers and of the nodes that the node follows.

The influence algorithm allows identifying which domain is the most influential within the network, that is, the domain whose removal would cause the greatest destabilization of the network. Said destabilization would affect a very high reduction or obstruction in the transmission of information through the different domains. To measure how the transmission of information within a graph is affected after eliminating a node, a density measure is used according to the following formula

AND

Dg N (N -1) (2)

Where E represents the number of links and N the number of nodes in the graph. Therefore, a domain ordering according to their influence would be one that had the lowest possible density after eliminating the fewest possible nodes within which they would have obtained a high rank score or value.

Once the rank value has been obtained for all the nodes, an evaluation procedure is carried out where the nodes that have obtained the highest rank value are eliminated from the graph one by one and the density is recalculated after each elimination. This process continues until the graph is completely disconnected, that is, with a density of 0. Through experimentation with different values, the values of 1.0 and 0.2 are assigned to the parameters respectively as the final values for the influence algorithm, since they are the ones that allow obtaining the lowest value of the area under the curve (AUC, “Area Under the Curve”), which is associated with the lowest possible density when eliminating the least number of nodes with the highest value ranking.

Figure 6 shows an example of the output of the data file that would contain the domains of the Tor darknet ordered according to the influence algorithm, indicating the influence within said darknet.

one

Claims (12)

1. Procedure for the classification and detection of the most influential domains within the Tor (1) dark web, characterized in that it comprises the following steps: - crawl a plurality of domains within the Tor dark network (1) and download raw text (3) from at least one domain (7), through a computer (2) connected to the internet and configured to access the network dark Tor (1); - obtain an HTML file (4) from the raw text (3); - preprocessing the raw text (5) to obtain a preprocessed text (6) and a plurality of incoming and outgoing hyperlinks extracted from the at least one domain (7); - perform an automatic classification (6a) of the preprocessed text (6) through a coding of the text using feature vectors and a regression-based machine learning algorithm, and obtain a series of domain categories (6b); - constructing a graph of activities of interest (8) from the incoming and outgoing hyperlinks extracted from the at least one domain (7); - determine the rank value (9) for each domain, which is obtained as the weighted combination of the sum of the number of links of each node, the links obtained from the hyperlinks to follower domains and followed by each domain (7) ; - perform an ordering of the nodes, and therefore of the corresponding domains, according to their rank value; - label the domains with the highest rank value as those most influential within the Tor darknet. 2. Method according to claim 1, wherein the preprocessing of the raw text (5) of the HTML files (4) comprises: - remove the HTML language tags; - remove the extension and leave the image name in the case of labels that reference images; - select domains in English with a language detection library; - remove special characters and stopwords through a list of stopwords; - edit and add a plurality of new stopwords to improve compatibility with the Tor darknet domain; - Unify all emails, web addresses and currencies in a single textual resource. 3. Method according to claim 1, wherein the step of performing an automatic classification of the domains (6a) comprises: - encode the text already processed by means of the Frequency of Terms-Inverse Document Frequency technique using a feature vector length of between three and 10000 elements; - train a machine learning algorithm with a labeled training set using Logistic Regression, and activating the balance of weights between classes; - classify, using the trained machine learning algorithm, the Tor (1) darknet domains into at least one of the nine defined classes: • pornography, • cryptocurrency, • credit card smuggling, • sale of illegal drugs, • violent activities, • cyber attacks, • counterfeiting of currency, • smuggling personal identification, and • others. 4. Method according to claim 1, comprising displaying a label of each text block (6) once it has been classified. 5. Method according to claim 1, comprising the construction of a graph of activities of interest (8) for the entire Tor dark network (1) and a graph of activities of interest (8) for each category resulting from the classification (6b ) through the incoming and outgoing hyperlinks (7) of each domain, where the construction of the graph of activities of interest comprises: - extract for each domain the incoming and outgoing hyperlinks belonging to the HTTP and HTTPS protocols; - Eliminate hyperlinks that have the same origin and destination, and hyperlinks that point to the Superficial Web; - Build a Graph of Activities of Interest, where the nodes correspond to domains, and the links to the different incoming and outgoing hyperlinks contained in the previous domains so that a link is generated between two one nodes A and B as long as domain A refers to domain B, or vice versa, at least once. 6. Procedure according to claim 1, comprising the calculation of the influence algorithm for all the domains of the Graph of Activities of global Interest (8), identifying as the most relevant domains within the Tor dark network those that obtain the highest rank values , where the calculation of the range value for any domain comprises: - initialize the range value with an initial weight based on the number of incoming and outgoing links of said node within the Graph of Activities of Interest; - update the rank value taking into account the initial weight and the weighted sum of the accumulated weight of its followers and followed domains, where the influence of the weights of the followers and followed domains is calculated through two parameters a, p. 7. Procedure according to claim 1, comprising the calculation of the influence algorithm for all the domains of the Global Interest Activities Graph (8) calculated for each category, identifying as the most relevant domains within each category of the Tor dark network those that obtain the highest range values within the selected category, where the calculation of the range value for any domain comprises: - initialize the rank value with an initial weight based on the degree of entry and exit of said node, that is, the number of incoming and outgoing links of said node within the Graph of Activities of Interest; - update the rank value taking into account the initial weight and the weighted sum of the accumulated weight of your followers and followed domains. The influence of the weights of the following and followed domains is calculated through two parameters a, fí. 8. System for the classification and detection of the most influential domains within the Tor dark network characterized by comprising data processing means (2) configured to: - crawl a plurality of domains within the Tor dark network (1) and download raw text (3) from at least one domain (7), through a computer (2) connected to the internet and configured to access the network dark Tor (1); - obtain an HTML file (4) from the raw text (3); one - preprocessing the raw text (5) to obtain a preprocessed text (6) and a plurality of incoming and outgoing hyperlinks extracted from the at least one domain (7); - perform an automatic classification (6a) of the preprocessed text (6) through a coding of the text using feature vectors and a regression-based machine learning algorithm, and obtain a series of domain categories (6b); - constructing a graph of activities of interest (8) from the incoming and outgoing hyperlinks extracted from the at least one domain (7); - determine the rank value (9) for each domain, which is obtained as the weighted combination of the sum of the number of links of each node, the links obtained from the hyperlinks to follower domains and followed by each domain (7) ; - perform an ordering of the nodes, and therefore of the corresponding domains, according to their rank value; - label the domains with the highest rank value as those most influential within the Tor darknet. System according to claim 8, comprising a computer (2) connected to the internet and configured to be able to access the dark network Tor (1), containing the program for tracking and downloading raw text (3), the program for the automatic classification of text (6a), the construction of the Graph of Activities of Interest (8), the calculation of the rank value for all the analyzed domains and the indication of the most relevant domains of the Tor dark web (10) a global level and by categories. System according to any of claims 8 to 9, comprising data storage means where the HTML files (4), the preprocessed text (6), the categories of the analyzed domains (6b) and the file of data with the lists of domains ordered according to their level of influence. A program product comprising program instruction means for carrying out the method defined in any one of claims 1 to 7 when the program is executed on a processor. 12. A program product according to claim 11, stored on a program support medium.