  The Tor darknet hosts different types of illegal content, which are monitored
by cybersecurity agencies. However, manually classifying Tor content can be
slow and error-prone. To support this task, we introduce Frequency-Dominant
Neighborhood Structure (F-DNS), a new perceptual hashing method for
automatically classifying domains by their screenshots. First, we evaluated
F-DNS using images subject to various content preserving operations. We
compared them with their original images, achieving better correlation
coefficients than other state-of-the-art methods, especially in the case of
rotation. Then, we applied F-DNS to categorize Tor domains using the Darknet
Usage Service Images-2K (DUSI-2K), a dataset with screenshots of active Tor
service domains. Finally, we measured the performance of F-DNS against an image
classification approach and a state-of-the-art hashing method. Our proposal
obtained 98.75% accuracy in Tor images, surpassing all other methods compared.

Computer Vision and Pattern Recognition