Characterizing Eve: Analysing Cybercrime Actors in a Large Underground Forum

Abstract

Underground forums contain many thousands of active users, but the vast majority will be involved, at most, in minor levels of deviance. The number who engage in serious criminal activity is small. That being said, underground forums have played a significant role in several recent high-profile cybercrime activities. In this work we apply data science approaches to understand criminal pathways and characterize key actors related to illegal activity in one of the largest and longestrunning underground forums. We combine the results of a logistic regression model with k-means clustering and social network analysis, verifying the findings using topic analysis. We identify variables relating to forum activity that predict the likelihood a user will become an actor of interest to law enforcement, and would therefore benefit the most from intervention. This work provides the first step towards identifying ways to deter the involvement of young people away from a career in cybercrime.

Understanding eWhoring

“…Instead, only text data were collected, excluding all files and images. Standard procedures were also established to enable the researchers to respond appropriately if such material were encountered, namely reporting it the UK's 'hotline provider', the Internet Watch Foundation, 3 which works with service providers to take down child sexual abuse material.…”

“…By understanding the steps and actions carried out in order to prepare for, undertake and complete such a crime, we can then identify potential intervention approaches [1]. eWhoring came to our attention through our analyses of online underground forums [2], [3]. These communities are used for trading in illicit material and sharing knowledge.…”

Measuring eWhoring

“…The heuristics are formed through our expertise in analysing forum data [19,25,27]. Concretely, for each thread we account for keywords frequently observed in TOP headings such as 'images', 'video' or 'unsaturated'.…”

“…These include trading virtual items obtained by illicit means, launching DDoS attacks using booter services, or obtaining and using malware [26,30]. The products and services made available by forum members lower the barrier to entry, enabling those without highly technical skills to engage in deviant or criminal activities [25].…”

Примена Анализе Социјалних Мрежа У Истраживањима Онлајн Криминалних Форума

“… Истраживање криминалних активности на четири оперативна и јавно доступна подземна форума (Pastrana, Hutchings, Caines, & Buttery, 2018), омогућио је посебно дизајниран софтвер за снимање података. Прикупљање података је вршено током девет месеци, (Rechavi et al, 2018), за прикупљање података коришћена је техника мрежног саобраћаја.…”