Dark Forums Research Articles

A hybrid framework using explainable AI (XAI) in cyber-risk management for defence and recovery against phishing attacks

Phishing and social engineering contribute to various cyber incidents such as data breaches and ransomware attacks, financial frauds, and denial of service attacks. Often, phishers discuss these attack vectors in dark forums. Further, the probability of phishing attacks and the subsequent loss suffered by the firm are highly correlated. In this context, we propose a hybrid framework using explainable AI techniques to assess cyber-risks generated from correlated phishing attacks. The first phase computes the probability of expert phishers within a community of similar attackers with varying expertise. The second phase calculates the probability of phishing attacks upon a firm even after it has invested in IT security and adopted regulatory steps. The third phase categorises phishing and genuine URLs using various machine-learning-based classifiers. Next, it estimates the joint distribution of phishing attacks using an exponential-beta distribution and quantifies the expected loss using Archimedean Copula. Finally, we offer recommendations for firms through the computation of optimal investments in cyber-insurance versus IT security. First, based on the risk attitude of a firm, it can use this explainable-AI (XAI) framework to optimally invest in building security into its enterprise architecture and plan for cyber-risk mitigation strategies. Second, we identify a long-tail phenomenon demonstrated by the losses suffered during most cyber-attacks, which are not one-off incidents and are correlated. Third, contrary to the belief that cyber-insurance markets are ineffective, it can guide financial firms to design realistic cyber-insurance products.

Differences in structure and dynamics of networks retrieved from dark and public web forums

Humans make decisions based on the information they obtain from several major sources, among which the comments of others in Internet forums play an increasing role. Such forums cover a wide spectrum of topics and represent an essential tool in choosing the best products, manipulating views or optimizing our decisions regarding a number of aspects of our everyday life. However, many forums have extremely controversial topics and contents including those which radicalize the readers or spread information about dangerous products and ideas (e.g., drugs, weapons or aggressive ideologies). These just mentioned activities are taking place mainly on the so called “dark web” allowing the hiding of the identity of members using dark forums. We use network theoretical approaches to analyze the data we obtained by studying the connectivity features of the members and the threads within a wide selection of forums (including dark and semi-dark) and establish several characteristic behavioral patterns. Our findings reveal both common and rather different features in the two types of behavior. In particular, we show that the various distributions of quantities, like the activity of the commenters, the dynamics of the threads (defined using their lifetime) or the degree distributions corresponding to the three major types of forums we have investigated display characteristic deviations. This knowledge can be useful, for example, in identifying an activity typical for the dark web when it appears in the public web (since the public web can be accessed and used much more easily).