PhD Research · University of Cincinnati

Measuring the I2P hidden-service ecosystem

How do I2P eepsites link to each other, how fast do they appear and disappear, and do the answers hold on Tor and Freenet? I answer these with application-layer crawling and a directed multiplex graph that joins network-layer and application-layer views of the same network.

Advisor: Dr. Jacques Bou Abdo2024 – presentDissertation expected Apr 2028

Three studies

Study 1Complete

Crawler coverage and resilience

Can an application-layer crawler find and keep up with I2P hidden services, and how much does it miss?

Crawled: 1,400 eepsites
Extracted: 366,304 hyperlinks
Data: IEEE DataPort, DOI

Study 2In progress

Eepsite churn and link-graph change

How quickly do eepsites appear, vanish and rewire, and what does that say about the ecosystem’s stability?

Code: GitHub repository
Target: [Expected completion]

Study 3Planned

Generalizing to Tor and Freenet

Do the same collection methods and graph findings carry over to other anonymity networks?

Start: [Planned start]

Illustrative representation of an eepsite relationship graph, showing clusters, hubs, and isolated sites

Fig. 01. This is an illustrative eepsite relationship graph, not Study 1 data. It shows clusters, hubs, and isolated sites in a hidden-service ecosystem.

How the work is done

Collection

Application-layer crawling of eepsites, with coverage checked against a validation set.

Analysis

A directed multiplex graph joins application-layer hyperlinks with network-layer relationships between the same sites.

Reproducibility

Datasets go to IEEE DataPort and code to GitHub, so results can be checked and rerun.

Research ethics. This work measures structure, not people. It does not identify or attribute real-world actors, and operational details that could aid abuse are left out of public write-ups.

Papers from this work

All publications →

Accepted

Chrono-GINE: Chronological Edge-Aware GIN for I2P Behavior Modeling

IEEE Intl. Conf. on Smart Data 2026 · Last author

Accepted

A Behavioral Temporal Graph Neural Network Framework for Detecting Botnets

IEEE iThings 2026 · Second author

Lab Build

Building a malware reversing lab on Proxmox

Read the write-up

The isolated analysis environment behind the investigations, written up so others can build it.