A Social Network Analysis and Comparison of Six Dark Web Forums

Abstract

With increasing monitoring and regulation by platforms, communities with criminal interests are moving to the dark web, which hosts content ranging from whistleblowing and privacy, to drugs, terrorism, and hacking. Using post discussion data from six dark web forums we construct six interaction graphs and use social network analysis tools to study these underground communities. We observe the structure of each network to highlight structural patterns and identify nodes of importance through network centrality analysis. Our findings suggest that in the majority of the forums some members are highly connected and form hubs, while most members have a lower number of connections. When examining the posting activities of central nodes we found that most of the central nodes post in sub-forums with broader topics, such as general discussions and tutorials. These members play different roles in the different forums, and within each forum we identified diverse user profiles.

HackerRank: Identifying key hackers in underground forums

“…24,25 In general, key hackers have high network centralities, such as degree centrality, eigenvector centrality, and PageRank. Pete et al 26 utilized network centrality analysis to highlight the structural patterns of each network to identify important nodes and key hackers. Zhang et al 10 proposed a new heterogeneous information network (HIN) embedding model named ActorHin2Vec to learn the low-dimensional representations for the nodes in HIN, and then a classifier was built for key actor identification.…”

The Impact of Adverse Events in Darknet Markets: an Anomaly Detection Approach

“…These titles sometimes do not reflect the actual roles users play in the market. Our future work will focus on refining the the anomaly detection approach by replacing user types with actual roles of the users which could be identified by utilising social network analysis techniques [35] which are currently under study. Further to this, the approach requires detailed analysis regarding parametric optimisation with specific emphasis on smaller sample sizes to see the impact of adverse events at a micro level, in order to further our understanding of darknet ecosystem.…”

“…In this paper, we introduce our anomaly detection approach not only to identify the adverse events which may or may not be known a priori but also to measure their impact on the activity of the DNM users. The approach is applied on a substantial number of datasets i.e., 35 DNM communities containing over 150,000 users [18]. More specifically, our key contributions are as follows:…”

Prompt-Based Learning for Thread Structure Prediction in Cybersecurity Forums

“…There are two network representations introduced [13] for building the social network in forums: Creator-oriented Network and Last Reply-oriented Network. The Last Reply-oriented Network is widely used for the social network analysis in the recent works [21,1,14,23,20,11]. Fig.…”