DecodeX
Home/Problem Statements/SIH26151
All 226 Statements
SIH26151SoftwareBlockchain & Cybersecurity
₹1,50,000 Prize (₹75k Joint)
•
Deadline: 20 September 2026
•
Submitted Ideas: 0/500

Dark web threat actor de-anonymization

Ministry / Organization: National Technical Research Organisation (NTRO)
SIH Official Portal
Technical Complexity
8/10
Dataset Accessibility
7/10
36h Hackathon Viability
9/10
Step 0 • Zero-Jargon Layman Summary

“This project aims to unmask anonymous criminals operating on the dark web by tracking their digital footprints across different sites. It connects hidden server mistakes, shared online identities, and behavioral patterns to reveal the real-world people behind illegal activities.”

The DecodeX PS Decoder™

Deconstructed Problem Blueprint

Step 1

WHAT TO BUILD?

An intelligence-gathering platform that scrapes dark web data, maps relationships between anonymous handles, and uses AI to deanonymize threat actors.

Step 2

WHO IS IT FOR?

National Technical Research Organisation (NTRO) and cybersecurity intelligence agencies.

Step 3

WHY DOES IT EXIST?

Criminals use Tor to mask their identity, making it nearly impossible for authorities to link illegal dark web actions to real-world individuals or physical infrastructure.

Step 4

INPUT → PROCESS → OUTPUT ARCHITECTURE PIPELINE

01 • Inputs & Telemetry

Tor hidden service URLs, marketplace forum data, PGP keys, cryptocurrency wallet addresses, and server configuration metadata.

02 • Processing & AI Core

Automated scraping, graph database construction for entity linking, stylometric analysis of text, and server misconfiguration scanning.

03 • Actionable Deliverables

A dashboard displaying relationship graphs, actor attribution confidence scores, and automated intelligence reports.

Step 5

CONSTRAINTS

  • Must handle non-standardized data formats from various dark web forums
  • Must operate with high ethical and legal compliance
  • Must maintain high precision to avoid false attribution
  • Must be capable of autonomous, continuous data ingestion
Step 6

JURY METRICS

  • Accuracy of persona linkage (Precision/Recall)
  • Graph traversal speed for large datasets
  • Confidence score reliability
  • UI/UX efficiency for intelligence analysts
Step 7

CORE BOTTLENECK

The 'Attribution Confidence' problem: Linking two pseudonymous personas with high certainty without triggering false positives that could lead to wrongful investigations.

Why You Should Choose This PS (Pros)

  • High national security impact
  • Clear, modular requirements (Infrastructure, Graph, AI)
  • Strong potential for advanced AI/ML implementation

Challenges & Risks to Watch (Cons)

  • Data collection is ethically sensitive and technically challenging
  • Requires robust handling of unstructured, noisy data
  • High risk of 'hallucination' in AI-based attribution
Hackathon Blueprint

Recommended Tech Stack & Grand Finale Features

Frontend & Mobile
React.jsCytoscape.js for graph visualizationTailwind CSS
Backend & APIs
FastAPIPythonCelery for task queuing
AI / ML & Models
BERT/RoBERTa for stylometryLangChain for RAGGraph Neural Networks (GNN)
Database & Cloud
Neo4j (Graph DB)PostgreSQLElasticsearch

Killer Features to Impress the SIH Jury

Real-time 'Confidence Score' calculator for every link found
Interactive 3D relationship graph with time-slider functionality
Automated 'Persona Migration' alert system
One-click PDF intelligence report generation
View Official SIH 2026 Portal Raw Text
▼
•Background The dark web has become a preferred operating space for threat actors in the modern age, mainly because it lets them hide their identity behind Tor hidden services, which makes attribution of threat actors operating on darkweb the main challenge for any investigation. Such threat actors carry out a wide range of unlawful activities such as drugs and arms sale, stolen data and hacking services, money laundering, terror financing, etc. The objective of this problem statement is to build a system for the deanonymization of dark web threat actors and link them to suspect real-world entities.
•Description The system shall deanonymize dark web threat actors by continuously gathering their footprints from a range of sources (marketplaces, forums, deep web etc.) and linking them to the identifying information available on those sources. The system envisages three core capabilities. First, finding misconfigurations in Tor hidden services—such as exposed server-status pages, SSL certificates tied to clearnet domains, default service banners, descriptor inconsistencies, etc and matching them with clearnet infrastructure to point to the likely origin servers. Second, mapping threat actors across multiple marketplaces into a single relationship graph of handles, PGP keys, wallets and trust links. Third, using AI-based analysis, including stylometric persona identification and behavioural profiling, to link rebranded or migrated personas to known threat actors. The system shall provide an analytical front end to query the database across a chosen timeline and shall work in an autonomous mode, drawing on available sources of good quality and reliability.
•Expected Solution An end-to-end system shall be developed for the collection, storage, contextualization and querying (through GUI/dashboards) of dark web threat actor intelligence—covering actor profiles, identifiers (handles, PGP keys, wallets etc.), hidden service infrastructure indicators, persona linkages, attribution confidence, category, last scan date and source. The system shall also provide the facility to export the result set in CSV, JSON and report formats.