Abstract
With the rapid development of the Internet, cybersecurity situation is becoming more and more complex. At present, surface web and dark web contain numerous underground forums or markets, which play an important role in cybercrime ecosystem. Therefore, cybersecurity researchers usually focus on hacker-centered research on cybercrime, trying to find key hackers and extract credible cyber threat intelligence from them. The data scale of underground forums is tremendous and key hackers only represent a small fraction of underground forum users. It takes a lot of time as well as expertise to manually analyze key hackers. Therefore, it is necessary to propose a method or tool to automatically analyze underground forums and identify key hackers involved. In this work, we present HackerRank, an automatic method for identifying key hackers. HackerRank combines the advantages of content analysis and social network analysis. First, comprehensive evaluations and topic preferences are extracted separately using content analysis. Then, it uses an improved Topic-specific PageRank to combine the results of content analysis with social network analysis. Finally, HackerRank obtains users’ ranking, with higher-ranked users being considered as key hackers. To demonstrate the validity of proposed method, we applied HackerRank to five different underground forums separately. Compared to using social network analysis and content analysis alone, HackerRank increases the coverage rate of five underground forums by 3.14% and 16.19% on average. In addition, we performed a manual analysis of identified key hackers. The results prove that the method is effective in identifying key hackers in underground forums.
Highlights
In the current cybersecurity situation, it is increasingly difficult to guard against advanced attacks or exploits
We propose a key hacker identification framework for underground forums, HR
In Social network analysis (SNA), user influence is obtained using an improved Topic-specific PageRank algorithm based on comprehensive evaluations and topic preferences
Summary
In the current cybersecurity situation, it is increasingly difficult to guard against advanced attacks or exploits. It is necessary to propose a method or tool to automate the analysis of underground forums and identify key hackers involved. Two main methods have been used to identify key hackers in underground forums: content-based analysis[7,8,9] and social network-based analysis.[10,11,12] Content-based approaches analyze user data based on selected evaluation metrics, such as activity and content quality. The specific contributions of this work are the following: This article proposes a framework for automatically analyzing key hackers in underground forums. Key hacker identification combines methods based on CA and SNA This method first extracts the user’s comprehensive evaluation metrics and topic preferences based on CA and applies our improved Topic-specific PageRank for SNA.
Sign-in/Register to view highlights & summary 
Published Version
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call