Dark web threat actor de-anonymization
National Technical Research Organisation (NTRO) · Blockchain & Cybersecurity · Software
The entity-graph and stylometry are solid, buildable work, but be honest that you are demonstrating a de-anonymisation method on constructed personas — you cannot manufacture the real adversary mistakes that genuine unmasking depends on.
What it actually is
Criminals operate on the dark web hidden behind Tor, which makes it very hard to work out who they really are. The ask is a system that gathers a threat actor's footprints across marketplaces and forums, links their handles, PGP keys and wallets into one profile, and tries to connect a hidden service or a rebranded persona back to a real-world entity.
What to build
An intelligence platform with three capabilities: an operational-security-failure detector that scans Tor hidden services for misconfigurations — exposed server-status pages, SSL certificates tied to clearnet domains, default banners, descriptor inconsistencies — and matches them against clearnet infrastructure to suggest likely origin servers; an entity-resolution graph linking handles, PGP keys, wallets and trust relationships across multiple marketplaces into a single actor profile; and an AI persona-linking layer using stylometry and behavioural profiling to connect rebranded or migrated personas to known actors, all queryable over a timeline through an analyst dashboard.
Smallest thing that wins the room
Feed the platform two marketplace personas that are actually the same actor and show it linking them through a shared PGP key and a stylometric match, then flag a hidden service whose SSL certificate leaks a clearnet domain, surfacing a candidate origin server.
How crowded this one gets
A guess, projected from the 2025 statements — the last year where both the submission counts and the winners were published.
Quieter than 82% of the 226 · #41 of 226 by expected field
Few teams are likely to go here. The best odds on the board come from statements like this.
Why: defence, intelligence and space bodies drew small fields.
This is a guess, not a fact
Nobody has published 2026’s numbers yet. This is an analysed estimate from last year’s pattern, so please do not take it as the truth — check the live counter on the SIH portal before you decide anything. The range covers the middle half of likely outcomes, so one statement in two lands outside it. Entry closes at 500 ideas per statement, so no range goes past that — a statement that reaches the cap fills and shuts rather than drawing an unlimited crowd. The model reads only three things a team can see before choosing — software or hardware, the theme, and what kind of body posted it — and those explain about a quarter of the variation in last year’s field sizes (R² 0.25 on held-out statements). Trust the band more than the number, and the ordering more than either. It cannot see how good your idea is, which is the part that actually decides it.
The scores
The number is the shorthand. The line under it is the reason.
Acceptance potential
3/5The entity-graph and stylometry are genuinely valuable and the field is thin, but the headline capability of de-anonymising real actors rests on adversary mistakes you cannot manufacture, and NTRO judges who do attribution professionally will distinguish a working method demonstrated on synthetic personas from an actual de-anonymisation.
Feasibility
2/5The entity-graph and stylometry pieces are buildable on public forum data, but the core capability — actually de-anonymising live Tor hidden services and linking to real entities — depends on adversary operational-security failures you cannot reliably reproduce, and scraping live dark-web marketplaces is legally and ethically fraught for a student team, so you will work on archived or synthetic data that cannot demonstrate real de-anonymisation.
Innovation scope
4/5How you fuse misconfiguration signals, cross-marketplace identifiers and stylometric evidence into a single attribution confidence is genuinely open, and combining these three very different signal types is where the real contribution lies.
Clarity
4/5The description numbers the three core capabilities precisely — misconfiguration matching, cross-marketplace identity graphing, and stylometric persona linking — so the target is well defined even though the data is not provided.
Effort
MassiveA crawling and collection layer, a misconfiguration scanner, an entity-resolution graph and a stylometry model are four substantial subsystems in different disciplines.
Demo-ability
MediumLinking two personas through a shared key and a stylometric match is a compelling story, but real de-anonymisation cannot be shown, so the demo runs on data you constructed and demonstrates the method rather than a genuine unmasking.
In its favour
- Green flag: Stylometry to link rebranded personas is a real, buildable technique that works on any text corpus you assemble, including public forum archives
- Green flag: The PGP-key and wallet entity graph is deterministic linkage that does not depend on any model accuracy
- Green flag: SSL-certificate-to-clearnet leakage is a documented real-world de-anonymisation vector you can demonstrate on a deliberately misconfigured test service
- Green flag: Attribution is precisely NTRO's mission, so a rigorous method resonates strongly with the judge
Against it
- Red flag: Real de-anonymisation depends on adversary operational-security failures you cannot reproduce on demand, so the headline capability is demonstrated on synthetic personas rather than genuine actors
- Red flag: Scraping live dark-web marketplaces is legally and ethically hazardous, so build on archived or synthetic corpora and say so explicitly
- Red flag: Stylometry accuracy collapses when an actor deliberately varies their writing, which sophisticated threat actors do, so your persona linking is weaker against exactly the targets that matter
- Red flag: Attribution is an accusation, so every link must carry confidence and evidence rather than being asserted
What you will be writing
- Stylometry / authorship attribution (BERT embeddings)
- PGP key and wallet entity-resolution graph (NetworkX)
- Tor hidden-service descriptor + certificate analysis
- Cross-marketplace handle linkage
- Behavioural profiling from posting patterns
- Timeline-queryable analyst dashboard
- Threat intelligence
- OSINT attribution
- Dark web forensics
Prior art to read before you start
cross-marketplace actor de-anonymisation · stylometric persona linking · hidden service misconfiguration attribution
Analysed by Claude Opus. Every score above is a judgment call with its reasoning attached — kindly cross-check this against the official statement on the SIH portal before your team commits to it.