HackerRank: Identifying key hackers in underground forums

Abstract

With the rapid development of the Internet, cybersecurity situation is becoming more and more complex. At present, surface web and dark web contain numerous underground forums or markets, which play an important role in cybercrime ecosystem. Therefore, cybersecurity researchers usually focus on hacker-centered research on cybercrime, trying to find key hackers and extract credible cyber threat intelligence from them. The data scale of underground forums is tremendous and key hackers only represent a small fraction of underground forum users. It takes a lot of time as well as expertise to manually analyze key hackers. Therefore, it is necessary to propose a method or tool to automatically analyze underground forums and identify key hackers involved. In this work, we present HackerRank, an automatic method for identifying key hackers. HackerRank combines the advantages of content analysis and social network analysis. First, comprehensive evaluations and topic preferences are extracted separately using content analysis. Then, it uses an improved Topic-specific PageRank to combine the results of content analysis with social network analysis. Finally, HackerRank obtains users’ ranking, with higher-ranked users being considered as key hackers. To demonstrate the validity of proposed method, we applied HackerRank to five different underground forums separately. Compared to using social network analysis and content analysis alone, HackerRank increases the coverage rate of five underground forums by 3.14% and 16.19% on average. In addition, we performed a manual analysis of identified key hackers. The results prove that the method is effective in identifying key hackers in underground forums.

A text-mining based cyber-risk assessment and mitigation framework for critical analysis of online hacker forums

“…While Benjamin et al [6] reported the number of threads started as a predictor of expertise, recent literature in cybersecurity and dark forum analysis have failed to recognize the sequence of message publication as a crucial predictor. Among the closest to this finding, Huang et al [27] and Marin et al [36] found that discussions started by key hackers were relevant and enabled the identification of expert hackers. Our findings are similar to Mousavi et al [38], who reported the presence of an "order effect" in online healthcare communities, where the first answer in a forum post by an expert positively influenced subsequent answers for a particular question.…”

“…Their study was able to find key hackers on forums with no reputation scores or even a fragile reputation system. Finally, Huang et al [27] proposed…”

A Graph-Based Stratified Sampling Methodology for the Analysis of (Underground) Forums

“…SNA is extensively used to identify key actors in underground forums [17], [31], [32]. Our centrality metric approach is similar to Pete et al [33], who constructed undirected graphs of six underground forums based on 6 months of observation, computed network statistics, and analyzed the network structure.…”

Hacker community detection in online social network: a case study

“…It extracts features of cybersecurity terms and builds a security word recognition model based on bidirectional LSTM networks and random forest algorithms, providing early warning capabilities for cybersecurity events. Huang Cheng et al [4] combined LDA topic analysis and network topology, proposing the HackerRank algorithm that utilizes an improved PageRank algorithm to effectively identify hacker communities and key members within the communities. Addressing the limited research on cross-forum activities in hacker forum monitoring, Andrew J.…”

“…Finally, we concatenate the global and local representations to derive the output of the encoding as in (4).…”