Tools for Automated Analysis of Cybercriminal Markets

Portnoff, Rebecca S.; Afroz, Sadia; Durrett, Greg; Kummerfeld, Jonathan K.; Berg-Kirkpatrick, Taylor; McCoy, Damon; Levchenko, Kirill; Paxson, Vern

doi:10.1145/3038912.3052600

Cited by 67 publications

(66 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Currency exchanges (e.g. converting bitcoin to PayPal) can be used for money laundering [35]. Other illicit activities include trading online stolen accounts [18], hacking Massively Multiplayer Online (MMO) games for profit [13], or advertising booter services, technically offered as "Service Stress Tools", but which are actually used for DDoS attacks [41].…”

Section: Scraping Underground Forumsmentioning

confidence: 99%

“…In some cases the datasets obtained by custom crawlers are incomplete. Portnoff et al present tools to analyse underground forums [35]. Their experiments relied on data from 8 forums, from which they partially scraped 3 of them and used complete dumps leaked for the remaining 5.…”

Section: Related Workmentioning

confidence: 99%

“…Their experiments relied on data from 8 forums, from which they partially scraped 3 of them and used complete dumps leaked for the remaining 5. While their dataset is publicly available, their focus was on the tools rather than the data and thus forums were only partially crawled [35]. The Open Discussion Forum Crawler (ODFC) use rules in the form of [path, pattern] to retrieve data from web forums.…”

Section: Related Workmentioning

confidence: 99%

“…Interest in these communities has increased in recent years and there is a wide literature on the analysis of cybercriminal forums, from different fields such as criminology, economics, cybersecurity and sociology (see Section 2.1). Research topics have included: how trust is managed [11], marketplace trade [35], and sharing of hacking material [37]. However, the interests and motivations of community members are widespread and evolve over time.…”

Section: Introductionmentioning

confidence: 99%

“…This is time consuming and requires technical expertise not necessarily found in the social sciences, thereby deterring research in this field. Most of the datasets that are available are either incomplete due to partial crawling [35], or come from leaked databases [32], which contain outdated data. Due to the dynamic nature of cybercriminal communities, we need tools that maintain updated datasets.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

CrimeBB

Pastrana

Thomas

Hutchings

et al. 2018

Proceedings of the 2018 World Wide Web Conference on World Wide Web - WWW '18

View full text Add to dashboard Cite

Underground forums allow criminals to interact, exchange knowledge, and trade in products and services. They also provide a pathway into cybercrime, tempting the curious to join those already motivated to obtain easy money. Analysing these forums enables us to better understand the behaviours of offenders and pathways into crime. Prior research has been valuable, but limited by a reliance on datasets that are incomplete or outdated. More complete data, going back many years, allows for comprehensive research into the evolution of forums and their users. We describe CrimeBot, a crawler designed around the particular challenges of capturing data from underground forums. CrimeBot is used to update and maintain CrimeBB, a dataset of more than 48m posts made from 1m accounts in 4 different operational forums over a decade. This dataset presents a new opportunity for large-scale and longitudinal analysis using up-to-date information. We illustrate the potential by presenting a case study using CrimeBB, which analyses which activities lead new actors into engagement with cybercrime. CrimeBB is available to other academic researchers under a legal agreement, designed to prevent misuse and provide safeguards for ethical research. CCS CONCEPTS• Information systems → Web crawling; • Security and privacy → Social aspects of security and privacy;

show abstract

Section: Scraping Underground Forumsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

CrimeBB

Pastrana

Thomas

Hutchings

et al. 2018

Proceedings of the 2018 World Wide Web Conference on World Wide Web - WWW '18

View full text Add to dashboard Cite

show abstract

Characterizing Eve: Analysing Cybercrime Actors in a Large Underground Forum

Pastrana

Hutchings

Caines

et al. 2018

Research in Attacks, Intrusions, and Defenses

View full text Add to dashboard Cite

Underground forums contain many thousands of active users, but the vast majority will be involved, at most, in minor levels of deviance. The number who engage in serious criminal activity is small. That being said, underground forums have played a significant role in several recent high-profile cybercrime activities. In this work we apply data science approaches to understand criminal pathways and characterize key actors related to illegal activity in one of the largest and longestrunning underground forums. We combine the results of a logistic regression model with k-means clustering and social network analysis, verifying the findings using topic analysis. We identify variables relating to forum activity that predict the likelihood a user will become an actor of interest to law enforcement, and would therefore benefit the most from intervention. This work provides the first step towards identifying ways to deter the involvement of young people away from a career in cybercrime.

show abstract

Mining Actionable Information from Security Forums: The Case of Malicious IP Addresses

Gharibshah

Castro

et al. 2019

Lecture Notes in Social Networks

View full text Add to dashboard Cite

The goal of this work is to systematically extract information from hacker forums, whose information would be in general described as unstructured: the text of a post is not necessarily following any writing rules. By contrast, many security initiatives and commercial entities are harnessing the readily public information, but they seem to focus on structured sources of information. Here, we focus on the problem of identifying malicious IP addresses, among the IP addresses which are reported in the forums. We develop a method to automate the identification of malicious IP addresses with the design goal of being independent of external sources. A key novelty is that we use a matrix decomposition method to extract latent features of the behavioral information of the users, which we combine with textual information from the related posts. A key design feature of our technique is that it can be readily applied to different language forums, since it does not require a sophisticated Natural Language Processing approach. In particular, our solution only needs a small number of keywords in the new language plus the user's behavior captured by specific features. We also develop a tool to automate the data collection from security forums. Using our tool, we collect approximately 600K posts from 3 different forums. Our method exhibits high classification accuracy, while the precision of identifying malicious IP in post is greater than 88% in all three forums. We argue that our method can provide singificantly more information: we find up to 3 times more potentially malicious IP address compared to the reference blacklist VirusTotal. As the cyber-wars are becoming more intense, having early accesses to useful information becomes more imperative to remove the hackers first-move advantage, and our work is a solid step towards this direction.

show abstract

Tools for Automated Analysis of Cybercriminal Markets

Cited by 67 publications

References 16 publications

CrimeBB

CrimeBB

Characterizing Eve: Analysing Cybercrime Actors in a Large Underground Forum

Mining Actionable Information from Security Forums: The Case of Malicious IP Addresses

Contact Info

Product

Resources

About