The NPS Phenomenon and the Deep Web : Trends Analyses and Internet Snapshots

Background: In relation to the phenomenon of novel psychoactive substances, activities on the surface web represent only the tip of the iceberg. The majority of the electronic commerce (e-commerce) activities exist on the deep web and the darknet. Observational analytic studies are failing to keep pace with these activities; these studies are either obsolete beyond the point in time of the taken internet snapshot or highly-consuming for resources including time, funding, and manpower. Materials and Methods: Cross-sectional and retrospective analyses via multiple Internet snapshots were carried out across Google Trends database and the e-markets on the darknet. Google Trends were scanned retrospectively (2012-2016) for keywords specific to the deep web in an aim to estimate and geo-map of the attentiveness (interest) of surface web users in the deep web and its illicit activities. Results: The attentiveness of surface web users in the deep web was noticed to be incremented during 2013 and 2014; the top ten contributing countries were Norway, Germany, Denmark, Austria, Poland, Sweden, Slovenia, Switzerland, Finland, and Netherlands. Middle Eastern countries contributed minimally including; Syria, Iran, Israel, UAE, Morocco, Egypt, and Saudi Arabia. Power scoring of e-markets revealed that the top five markets were; AlphaBay, Agora, Nucleus, Abraxas, and Hansa. The most common categories of NPS on these markets were; cannabis and cannabimimetic (1), stimulants (2), empathogens (3), and psychedelics (4). Conclusion: The e-commerce activities on the deep web and the darknet e-marketplace represent an integral component of the NPS e-phenomenon. Unfortunately, recent attempts to examine and study those unlawful activities are outdated. Hence, to achieve real-time and reliable data, the inclusion of data mining tools and knowledge discovery in databases are critical to ensuring a future victory.


Background
The phenomenon of New psychoactive substances (NPS) growth is escalating exponentially on both divisions of the web; surface and deep (Al-Imam et al., 2016;Al-Imam et al., 2017).This logarithmic spread has also been paralleled by numerous attempts from NPS researchers to counteract its public, health, and economic threats.These attempts have increased from 2010 onward, but they are still partially incapable of facing the "ballooning" progression of the phenomenon; one of the main reasons for that is the anonymous e-trade (e-commerce) activity on the infinite virtual space of the deep web (Chaabane et al., 2010;Mobasher et al. 2001).Several e-markets exist on the deep web, primarily on the darknet which is accessible by means of dedicated search engines from any spot in the world (Biddle et al., 2002;Buxton & Bingham, 2015;Flick et al., 2013).These e-markets include; the renowned AlphaBay, Agora, Nucleus, Valhalla, and dozens more (Laura & Me, 2015;Van Buskirk et al., 2016).common analytic tool for examining the deep web is known as the Internet snapshot method.However, this technique is not only time-consuming, having modest accuracy, and of low level-of-evidence, but it also requires the dedication of time and financial resources (Pastor-Satorras et al., 2001;Siddiqi et al., 2015).Therefore, in this study, a strive to perfect the internet snapshot will be enacted to; enhance the accuracy of the snapshot method (1), improve the generated level-of-evidence (2), reduce time and efforts (3), implement the application of inferential statistics (4), and discuss the potential use of data mining technologies and knowledge discovery in databases (5) (Berry & Linoff, 1997;Fayyad et al., 1996).
This study is a cross-breed made of an integrative observational analysis of Google Trends database and the e-markets on the darknet.The aims are to; extrapolate the interest of surface web users in the deep web and its incognito e-markets, infer the geographic mapping (countries) of those surface web users, quantify the e-markets on the darknet by assessing each e-market's power (authority), and to infer the most popular categories of NPS on these e-markets.Pertinent geo-mapping of the Middle East and the Arab world will be accompanying each of these steps.A comparison between the European Union and the Middle East will also be made to estimate the proportional contribution of each in connection with the magnitude of the e-trade activities on the darknet.

Materials and Methods
The e-trade of NPS on the deep web has been assessed via observing the anonymous e-markets on the deep web; this systematic analysis has been initiated by studying the surface web users' interest (attentiveness) towards the deep web and its darknet e-marketplace.This has been assessed by observing the time-related (chronological) changes of five keywords on Google Trends; the keywords are Deep web, Darknet, Tor, Bitcoin network, and Bitcoin (Google, 2017).These keyword terms are representative for the deep web, the darknet, the Tor web browsers, and the Bitcoin payment system (McCoy et al., 2008;Reid and Harrigan, 2013).The historical analysis (2012-2016) of keywords was followed by geographic mapping (geo-mapping) in an attempt to; localise surface web users of the high tendencies to use the deep web and its e-markets (1), and assess the contribution of users from the Middle East and Arabic country, if any exist (2).This analysis is observational and retrospective (longitudinal).
Analysis of the majority of contributing e-markets on darknet was done; these e-markets include Hansa, Darknet Hero League, AlphaBay, Agora, Nucleus Market, Majestic Garden, Real Deal Market, Oasis, Abraxas, Outlaw Market, Middle Earth, Silkkitie, Oxygen, Tochka Market, and Arsenal (Biddle et al., 2002;Al-Imam, 2017;Al-Imam et al., 2017).Assessing each market relied on the concept of the individual basis of power (authority) implemented in social sciences (French et al., 1959;Spekman, 1979).Each e-market has been assessed for its power by analysing three indices; overall rating (1), support rating (2), and the number of votes (3); these data were retrieved from the Grams search engine of the darknet (Laura and Me, 2015;Nakov, 2005).Tabulation of the three power indices was followed by a digital correction (standardisation) and mathematical calculation of a power score unique for each e-market.Hence, the analysis is observational, and it is based on an Internet snapshot which was taken on the 9 th of February 2017.
The 3 rd and final step was the analysis of the advertised NPS on five of the most popular e-markets; the e-markets are; AlphaBay, Valhalla, HANSA, Acropolis, and Tochka; these e-markets were randomly selected using a random number generator.The e-trade of NPS on the darknet was usually classified into eight categories or less (depending on the e-market).The categories included; Benzodiazepine (1), Cannabis, Hashish, and Cannabimimetics (2), Dissociative substances (3), Empathogens including ecstasy (4), Opioids (5), Prescription-related substances (6) Stimulants and psychostimulants (7), and Psychedelics (8).A subsequent analysis involved the substances enlisted under each of these categories.This step (3 rd step) led to an extrapolation in relation to the most popular (trending) categories of NPS on darknet e-markets, which was preceded by identifying the most influential (dominant) e-markets on the darknet.
Each of the three analytic steps was paralleled by statistical analyses (descriptive and inferential); statistical inference implemented several tests including; the analysis of variance and covariance (ANOVA), Student's t-test (paired and unpaired), regression models, and nonparametric test.Alpha (α) value of 0.05 and a confidence interval of 95% (95% CI) was set as the cutoff margin for statistical significance.Descriptive statistics were endeavoured to; point out unique data events (statistical outliers), and to explain why these events occurred.Geo-mapping will also be implemented for the region of the Middle East, Arabic Countries, and the European Union.

Results and Discussion
Analyses of Google Trends database appears to be steady to some degree (Figure 1) with an exception for the keyword Bitcoin; attentiveness to this keyword seems to soar during 2013-2014 and specifically in March-April 2013, October 2013-March 2014, and December 2016-January 2017.The highest peak for Bitcoin was reached in November 2013.Descriptive statistics clearly shows that the surface web users are highly interested in two main keywords; Tor (17.7 +/-2.1) and Bitcoin (17.5 +/-14.9),while the other keywords averaged; Deep web (5.9 +/-2.7),Darknet (0.9 +/-1), and Bitcoin network (1.3 +/-1.5).The attentiveness towards the keyword Bitcoin network was noticed to be synchronised with the attentiveness towards the keyword Bitcoin; both keywords peaked at the end of November 2013.It is important to know that In October 2013, the Chinese Baidu search engine allowed its users to implement the Bitcoin payment system.Furthermore, in November, it was estimated that approximately 12 million bitcoins were mined in e-payments, and remarkably by the 23 rd of November 2013, the total market of bitcoins in the United States has exceeded 10 billion US dollars (Chang G, 2013;Fensch J, 2014;Hendrickson et al., 2015).On the other hand, attentiveness towards the keyword Deep web increased from May till November 2015; it reached a peak in August 2015.The other two keywords, Darknet and Tor, appears to more steady; the keyword Darknet was found to be of the least importance for surface web users.The soaring attentiveness of surface web users towards particular keywords (Tor, Bitcoin, and Deep web) was also validated via Boxplot presentation (Figure 2); statistical outliers were also evident in relation to the keyword Bitcoin.Geo-mapping of the keywords showed that the contribution of five countries was phenomenal (statistical outliers); these countries are (descending order) were Bangladesh, Norway, Germany, Denmark, and Ghana (Figure 4).Other top contributing countries included; Austria, Nigeria, Sweden, Pakistan, Switzerland, Finland, Netherlands, Bolivia, Poland, the Czech Republic, US, UK, and Canada.Apparently, Bangladesh and some African countries are in the top of the list which may be attributed to the ban of social media networks in those countries leading to the use of the anonymous deep web as an alternative "hacking" solution to access the social media, including Facebook and Twitter (Aliens, 2017).Middle Eastern and Arabic countries included (descending order); Syria, Iran, UAE, Israel, Algeria, Morocco, Saudi Arabia, and Egypt (Figure 4).This contribution represented a tiny fragment (7.1%) of the global geo-mapping.Concerning the geo-mapped countries, linear regression has confirmed a positive linear correlation between two the keywords Tor and Bitcoin (R 2 score=0.044),which has further confirmed that the trends of these two keywords were synchronised for the period 2012-2016.On the other hand, there was some degree of negative correlation between Tor keyword and; Bitcoin network (0.016) and Darknet (0.044).A comparison was also set between countries from the European Union to infer the existence of significant differences, Norway was an apparent statistical outlier.Student's t-test (independent) was used for statistical inference (Figure 5).Accordingly, it was found that the Middle East contributed much less (p-value<0.001)than countries from the EU.Hence, the attentiveness of EU surface web users was the highest in relation to the mapped keywords for the period 2012-2016.Norway (rank 1 st ) and Germany (rank 2nd) represented the top contributing countries from the EU (Figure 6)., 2017).The power score analysis revealed two outliers (exceptionally attractive) e-markets; AlphaBay and Agora (Figure 7).It seems that AlphaBay is the principal market on the darknet.Descriptive Statistics (Table 1, Figure 8) naturally visualise that the top three e-markets (AlphaBay, Agora, and Nucleus Market) are in the lead with a big gap over other e-markets.Inferential analysis, using linear regression, shows a positive linear correlation between; power score and the number of votes (R 2 score=0.961),overall rating and support rating for each e-market (R 2 =0.549).Furthermore, the power score was rearranged in descending order to permit the analysis of high-power versus low-power e-markets.Initially, a comparison was made between the top seven markets and the remaining eight e-markets (Figure 9), which showed a clear leverage of the top seven e-markets (p-value=0.006).Even when comparing the strongest two e-markets versus the remaining 13 e-markets, AlphaBay and Agora were still proven superior (p=0.018).The final analytic step was to pick five e-markets from the darknet and perform an observational analysis of the advertised NPS (Figure 10 and 11).A random number generator was used, the five e-markets were; AlphaBay, Valhalla, HANSA, Acropolis and Tochka.The randomization in selection aims to; prevent selection bias, and to assess the heterogeneity of advertised substances (NPS) within e-markets of different power-scoring.The Internet snapshot was taken on the 25 th of February 2017.Categories of NPS found on AlphaBay were; Benzodiazepine (14860 items), Cannabis and Hashish (65275), Dissociatives (4319), Ecstasy (30207), Opioids (16889), Prescription (8736), Stimulants (33098), and Psychedelics (14007).Valhalla categorised the NPS as; Cannabis and Hashish (3917), Stimulants (2266), Empathogens (2108), Psychedelics (1065), Opioids (944), Prescription (1766), Dissociatives (258),and Depressants (53).HANSA e-market advertised NPS as; Cannabis and Hashish (4796), Opioids (535), Psychedelics (1313), Prescription (1345), Stimulants (2582), Ecstasy (2780), Benzodiazepine (730), and Dissociatives (360).On the other hand Acropolis e-market adopted a bit different categorization system; Benzodiazepine (3), Cannabis and Hashish (186), Dissociatives (6), Ecstasy (52), Opioids (34), , Psychedelics (59), Stimulants (52), Research Chemicals (3), and Barbiturates (1).The 5 th e-market, Tochka, categorised NPS in a classical way; Cannabis (108), Stimulants (53), Psychedelics (21), Empathogens (17), Opioids (7), Dissociatives (6), Prescription (44), and Others (20).It seems that four categories of NPS dominated each of these five e-markets, these classes are; cannabis-hashish and cannabinoids (rank 1 st ), Stimulants (rank 2 nd ), empathogens (rank 3 rd ), and psychedelics (rank 4 th ).
Furthermore, the number of items, under the category of cannabis and cannabinoids, behaved as a statistical outlier in Acropolis e-market; cannabis and cannabinoids have contributed to 45.6% of the total number of substances advertised within the Acropolis e-market.However, inferential statistics revealed that there was no statistically significant difference in the number of items which were sold under each of the top four NPS categories (Figure 12).On the other hand, there was a significant difference in relation to the number of items advertised on all of the randomly selected e-markets (Figure 13), with an exception for the number of substances on Acropolis and Tochka e-markets (p-value=0.09).It is to be deducted that AlphaBay e-market is always in the lead, while cannabis and cannabimimetic represent the most popular category of NPS in circulation within the darknet e-marketplace.

Conclusion
The deep web is not only anonymous but also an enormous virtual place in which an observer can quickly be overwhelmed while conducting an observational analysis or taking a snapshot.However, this study implemented a tactical approach to render the task; easier, more focused, and made of as minimum observations as possible.The tactic is made of three overlapping steps, the 1 st one relies on Google trends analyses to estimate the interest (attentiveness) of surface web users in the deep web, and the geo-mapping of the contributing countries including those from the Middle East and the Arab World.The 2 nd and 3 rd steps are carried out on the deep web itself to infer; the basis of power for the e-markets on the darknet, and the most common NPS on the e-marketplace.AlphaBay and Agora were found to be dominating the e-marketplace, while the most frequently sold categories of NPS included cannabimimetic, stimulants, empathogens, and psychedelics.This simplified yet systematic Internet snapshot technique can be repeated at any given moment of time.Besides, when this method is combined with powerful tools for data mining, the data output should be highly accurate, and in real-time; the reduction in time and efforts should be remarkable.

Figure 2 .
Figure 2. Keywords Mapped on Google Trends: Boxplot Presentation

Figure 3 .
Figure 3. Inferential Statistics: Keywords Mapping on Google Trends

Figure 4 .
Figure 4. Geo-mapping of the Keywords on Google Trends (2012-2016): Contributing Countries in Descending order (above), Juxtaposition of Middle Eastern Contribution (below)

Figure 5 .
Figure 5. Inferential Statistics of Regional Geo-mapping: The Middle East and the European Union

Figure 7 .
Figure 7. Power Score of e-markets on the Darknet: Pareto Chart.

Figure 8 .
Figure 8. Power Scoring of e-markets on the Darknet

Figure 9 .
Figure 9. Inferential Statistics: Analyses of High-power versus Low-power e-markets

Figure 10 .
Figure 10.Most Popular Categories of NPS on the Darknet

Figure 12 .Figure 13 .
Figure 12.Most Popular Categories of NPS on the Darknet e-markets

Table 1 .
Power Scoring of e-markets on the Darknet