Breadcrumbs in the Digital Forest: Tracing Criminals through Torrent Metadata with OSINT

• URL: http://arxiv.org/abs/2601.01492v1
• Date: Sun, 04 Jan 2026 11:39:32 GMT
• Title: Breadcrumbs in the Digital Forest: Tracing Criminals through Torrent Metadata with OSINT
• Abstract summary: This work investigates the potential of torrent metadata as a source for open-source intelligence (OSINT)<n>Data was collected from The Pirate Bay and trackers, yielding a dataset of more than 60,000 unique IP addresses across 206 popular torrents.<n>The study shows that publicly available torrent metadata can support scalable and automated OSINT profiling.
• Score: 0.8602553195689513
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: This work investigates the potential of torrent metadata as a source for open-source intelligence (OSINT), with a focus on user profiling and behavioral analysis. While peer-to-peer (P2P) networks such as BitTorrent are well studied with respect to privacy and performance, their metadata is rarely used for investigative purposes. This work presents a proof of concept demonstrating how tracker responses, torrent index data, and enriched IP metadata can reveal patterns associated with high-risk behavior. The research follows a five-step OSINT process: source identification, data collection, enrichment, behavioral analysis, and presentation of the results. Data were collected from The Pirate Bay and UDP trackers, yielding a dataset of more than 60,000 unique IP addresses across 206 popular torrents. The data were enriched with geolocation, anonymization status, and flags of involvement in child exploitation material (CEM). A case study on sensitive e-books shows how such data can help detect possible interest in illicit content. Network analysis highlights peer clustering, co-download patterns, and the use of privacy tools by suspicious users. The study shows that publicly available torrent metadata can support scalable and automated OSINT profiling. This work adds to digital forensics by proposing a new method to extract useful signals from noisy data, with applications in law enforcement, cybersecurity, and threat analysis.

Related papers

• Leave No TRACE: Black-box Detection of Copyrighted Dataset Usage in Large Language Models via Watermarking [51.74368870268278]
  We propose TRACE, a framework for fully black-box detection of copyrighted dataset usage in large language models.<n>textttTRACE rewrites datasets with distortion-free watermarks guided by a private key.<n>Across diverse datasets and model families, TRACE consistently achieves significant detections.
  arXiv  Detail & Related papers  (2025-10-03T12:53:02Z)
• Combining Knowledge Graphs and NLP to Analyze Instant Messaging Data in Criminal Investigations [0.2893969925652728]
  Criminal investigations often involve the analysis of messages exchanged through instant messaging apps such as WhatsApp.<n>Our approach integrates knowledge graphs and NLP models to support this analysis by semantically enriching data collected from suspects' mobile phones.<n>We adopt two different solutions to help users get insights into the data, one based on querying and visualizing the graph, and one based on semantic search.
  arXiv  Detail & Related papers  (2025-09-30T16:32:26Z)
• An Identity and Interaction Based Network Forensic Analysis [0.7957417670045067]
  This paper presents experiments designed to create a novel NFAT approach that can identify users and understand how they are using network based applications.<n>The experiments profiled across 27 users, has yielded an average 93.3% True Positive Identification Rate (TPIR)<n>Skype, Wikipedia and Hotmail services achieved a notably high level of recognition performance.
  arXiv  Detail & Related papers  (2025-03-24T10:52:23Z)
• A Federated Learning Approach for Multi-stage Threat Analysis in Advanced Persistent Threat Campaigns [25.97800399318373]
  Multi-stage threats like advanced persistent threats (APT) pose severe risks by stealing data and destroying infrastructure. APTs use novel attack vectors and evade signature-based detection by obfuscating their network presence. This paper proposes a novel 3-phase unsupervised federated learning (FL) framework to detect APTs.
  arXiv  Detail & Related papers  (2024-06-19T03:34:41Z)
• Did You Train on My Dataset? Towards Public Dataset Protection with Clean-Label Backdoor Watermarking [54.40184736491652]
  We propose a backdoor-based watermarking approach that serves as a general framework for safeguarding public-available data. By inserting a small number of watermarking samples into the dataset, our approach enables the learning model to implicitly learn a secret function set by defenders. This hidden function can then be used as a watermark to track down third-party models that use the dataset illegally.
  arXiv  Detail & Related papers  (2023-03-20T21:54:30Z)
• ConfounderGAN: Protecting Image Data Privacy with Causal Confounder [85.6757153033139]
  We propose ConfounderGAN, a generative adversarial network (GAN) that can make personal image data unlearnable to protect the data privacy of its owners. Experiments are conducted in six image classification datasets, consisting of three natural object datasets and three medical datasets.
  arXiv  Detail & Related papers  (2022-12-04T08:49:14Z)
• Black-box Dataset Ownership Verification via Backdoor Watermarking [67.69308278379957]
  We formulate the protection of released datasets as verifying whether they are adopted for training a (suspicious) third-party model. We propose to embed external patterns via backdoor watermarking for the ownership verification to protect them. Specifically, we exploit poison-only backdoor attacks ($e.g.$, BadNets) for dataset watermarking and design a hypothesis-test-guided method for dataset verification.
  arXiv  Detail & Related papers  (2022-08-04T05:32:20Z)
• Generative Conversational Networks [67.13144697969501]
  We propose a framework called Generative Conversational Networks, in which conversational agents learn to generate their own labelled training data. We show an average improvement of 35% in intent detection and 21% in slot tagging over a baseline model trained from the seed data.
  arXiv  Detail & Related papers  (2021-06-15T23:19:37Z)
• Malware Traffic Classification: Evaluation of Algorithms and an Automated Ground-truth Generation Pipeline [8.779666771357029]
  We propose an automated packet data-labeling pipeline to generate ground-truth data. We explore and test different kind of clustering approaches which make use of unique and diverse set of features extracted from this observable meta-data.
  arXiv  Detail & Related papers  (2020-10-22T11:48:51Z)
• TIPRDC: Task-Independent Privacy-Respecting Data Crowdsourcing Framework for Deep Learning with Anonymized Intermediate Representations [49.20701800683092]
  We present TIPRDC, a task-independent privacy-respecting data crowdsourcing framework with anonymized intermediate representation. The goal of this framework is to learn a feature extractor that can hide the privacy information from the intermediate representations; while maximally retaining the original information embedded in the raw data for the data collector to accomplish unknown learning tasks.
  arXiv  Detail & Related papers  (2020-05-23T06:21:26Z)
• Extracting Entities and Topics from News and Connecting Criminal Records [6.685013315842082]
  This paper summarizes methodologies used in extracting entities and topics from a database of criminal records and from a database of newspapers. Statistical models had successfully been used in studying the topics of roughly 300,000 New York Times articles. analytical approaches, especially in hotspot mapping, were used in some researches with an aim to predict crime locations and circumstances in the future.
  arXiv  Detail & Related papers  (2020-05-03T00:06:01Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.