Dark Web Forums Research Articles

Framework for Mitigating Phishing E-mail in the Kenyan Banking Industry Using Artificial Intelligence (AI)

Purpose: Phishing is a significant cybercrime threat that affects individuals and organizations globally, including the banking industry in Kenya. The sophistication of phishing attacks continues to increase, and it is increasingly challenging traditional security measures to mitigate these threats. The purpose of this thesis is to build a framework for mitigating phishing e-mail attacks in the banking industry in Kenya using artificial intelligence. Phishing emails are among the most common techniques of cyber-attacks utilized by assailants to gain unauthorized access to sensitive information such as financial details, personal information, and login credentials. These attacks can have devastating effects on the victims, leading to financial loss, reputation damage, and even identity theft. Methodology: The framework development consists of four main stages: data collection, data preprocessing, model training, and deployment. In the data collection stage, a dataset of phishing and non-phishing emails is gathered from various sources such as public databases, dark web forums, and bank employees mail. In the data preprocessing stage, the collected data is cleaned, preprocessed, and labeled. In the model training stage, machine learning algorithms and NLP techniques is used to develop a robust phishing and non-phishing emails detection model. In the deployment stage, the model is integrated into the bank's email system to detect and block phishing emails in real-time. The framework is then evaluated using a dataset of phishing and non-phishing e-mails collected from the banking industry in Kenya. Various metrics such as accuracy, precision, recall, and F1-score are used to evaluate the framework. The framework is able to detect new phishing e-mails that were not previously included in the dataset, demonstrating its ability to adapt to new threats. Findings: The framework is based on a hybrid approach that combines machine learning algorithms, natural language processing (NLP) techniques, and human expertise that identify and prevent phishing emails from reaching their targets. The four main components of this framework include e-mail filtering, feature extraction, classification, and response. The e-mail filtering component uses several algorithms to identify and filter suspicious e-mails. The feature extraction component analyzes the content of the e-mail and extracts relevant features to help classify the e-mail as either legitimate or phishing. The classification component uses machine-learning algorithms to classify the e-mail as either legitimate or phishing. Finally, the response component takes appropriate action based on the classification results. Unique Contribution to Theory, Practice and Policy: The framework provides an effective way to identify and mitigate phishing e-mail attacks, reducing the risk of data breaches and financial losses.

The Evolving Threat Landscape: How Cyber Threat Intelligence Empowers Proactive Defenses against WannaCry Ransomware

Cyber threat intelligence (CTI) is a rapidly growing field that plays an essential role in ensuring the security of online systems. CTI refers to the intelligence that is gathered, analyzed, and disseminated to help organizations understand and respond to cyber threats. This information can be used to identify vulnerabilities, detect potential attacks, and develop strategies to mitigate risks. The field of CTI is constantly evolving, as cyber threats become more sophisticated and complex. Legacy security measures like firewalls and anti-virus software are no longer enough to protect organizations from the many threats they face. CTI provides a proactive approach to cybersecurity, by enabling organizations to anticipate and prepare for threats before they occur. CTI relies on the collection and analysis of data from multiple sources, such as open-source intelligence (OSINT), dark web forums, social media, and other threat intelligence streams. The data is analyzed using a wide range of tools and techniques, including machine learning and artificial intelligence, to identify patterns and trends that may indicate a potential threat. One of the key benefits of CTI is its ability to help organizations understand the tactics, techniques, and procedures of attackers. By analyzing the behaviors, strategies, tactics, and actions of threat actors, organizations can develop a more comprehensive understanding of the threats they face and can better prepare for potential attacks.

Dark Web Activity in the Japanese Language Between 2004 and 2020: A Case Study of the Onion Channel

ABSTRACT This paper investigates the activity of Japanese-language dark web sites by examining a Japanese dark web forum, the Onion Channel. While global crypto markets and English-language forums have been extensively studied, there has been little research on Japanese-language dark web sites. The number of posts and the variety of activities on the Onion Channel started increasing around mid-2012, exhibited steady growth until the end of 2016, and then showed a declining trend toward mid-2020. This study classifies activities on the forum into 10 categories. The forum was dominated by illegal and unethical activity. In particular, illegal drug dealing and cyberbullying were the two major illegal and unethical activities that took place there. The large presence of drug-related activity suggests that the forum on the dark web operated as a substitute for crypto markets. Textual analysis revealed that cannabis and methamphetamine were two major drugs that were likely to be sold, and those deals were likely to be completed face-to-face at a designated location. There was also a certain amount of illegal content, such as information related to fraud, identity theft and sales of false IDs, and hacking, as well as criminal conversations.

Discovering child sexual abuse material creators' behaviors and preferences on the dark web

BackgroundProducing, distributing or discussing child sexual abuse materials (CSAM) is often committed through the dark web to stay hidden from search engines and to evade detection by law enforcement agencies. Additionally, on the dark web, the CSAM creators employ various techniques to avoid detection and conceal their activities. The large volume of CSAM on the dark web presents a global social problem and poses a significant challenge for helplines, hotlines and law enforcement agencies. ObjectiveIdentifying CSAM discussions on the dark web and uncovering associated metadata insights into characteristics, behaviors and motivation of CSAM creators. Participants and SettingWe have conducted an analysis of more than 353,000 posts generated by 35,400 distinct users and written in 118 different languages across eight dark web forums in 2022. Out of these, approximately 221,000 posts were written in English and contributed by around 29,500 unique users. MethodWe propose a CSAM detection intelligence system. The system uses a manually labeled dataset to train, evaluate and select an efficient CSAM classification model. Once we identify CSAM creators and victims through CSAM posts on the dark web, we proceed to analyse, visualize and uncover information concerning the behaviors of CSAM creators and victims. ResultThe CSAM classifier, based on Support Vector Machine model, exhibited good performance, achieving the highest precision of 92.3 % and accuracy of 87.6 %. While, the Naive Bayes combination is the best in term of recall, achieving 89 %. Across the eight forums in 2022, our Support Vector Machine model detected around 63,000 English CSAM posts and identified near 10,500 English CSAM creators. The analysis of metadata of CSAM posts revealed meaningful information about CSAM creators, their victims and social media platforms they used. This included: (1) The topics of interest and the preferred social media platforms for the 20 most active CSAM creators (For example, two top creators were interested in topics like video, webcam and general content in forums, and they frequently used platforms like Omegle and Skype); (2) Information about the ages and nationalities of the victims typically mentioned by CSAM creators, such as victims aged 12 and 13 with nationalities including British and Russian; (3) social media platforms preferred by CSAM creators for sharing or uploading CSAM, include Omegle, YouTube, Skype, Instagram and Telegram. ConclusionOur CSAM detection system exhibits high performance in precision, recall, and accuracy in real-time when classifying CSAM and non-CSAM posts. Additionally, it can extract and visualize valuable and unique insights about CSAM creators and victims by employing advanced statistical methods. These insights prove beneficial to our partners, i.e. national hotlines and child agencies.

Examining risk and risk perception on LSD and MDMA in online marketplaces

ABSTRACT The anonymity provided in underground forums has led to the growth of illicit substance drug markets. Online markets seem to be safer for drug transactions, with reduced risks of being arrested. However, criminals seem to be conscious of the risks of keeping a dark web market user friendly. This study investigates both surface and dark web forums, focusing on online underground markets. This study aims to: a) investigate the ways risk is perceived among members and vendors of underground forums throughout stages of transactions and b) identify risk avoidance practices utilised within these online underground markets. We hypothesise that the discourse in these forums focuses on the risks of detection, both offline and in cyberspace, as well as relevant techniques for reducing such risks. Our findings indicate discourse on techniques and strategies for reducing the risk of detection and arrest. In addition, our findings highlight that decision-making with drug use is highly individualised and should be based on some research of the effects and benefits of each drug. These findings provide useful insights and can inform practices in policing, leading to the development of intervention approaches aiming to interrupt online underground markets.

Towards Detecting Influential Members and Critical Topics from Dark Web Forums

Conventionally, the Internet consists of three parts: Surface, Deep, and Dark Webs. Inthe last two decades, a massive increase in illicit activities took place on the differentplatforms of the Dark Web. Moreover, social networks on Dark Web implicateextremism dissemination on a wide scale. In this paper, we propose an approach togenerate textual patterns from discussions on Dark Web terrorist forums employingData Mining techniques. The discovered patterns help identify the influential membersand extract critical topics. We describe our system modules that perform datapreprocessing, text preprocessing with TF-IDF weighting, outlier detection, clusteringevaluation, clustering, and clustering validation, implemented with the RapidMinertool. We apply K-Means as the Clustering method with different distance metrics,evaluate the clustering process using Elbow and Silhouette methods, and validate itusing Davies-Bouldin Index. Furthermore, we investigate the effects of altering thedistance metrics for outlier detection on the Clustering results.

Towards Safe Cyber Practices: Developing a Proactive Cyber-Threat Intelligence System for Dark Web Forum Content by Identifying Cybercrimes

The untraceable part of the Deep Web, also known as the Dark Web, is one of the most used “secretive spaces” to execute all sorts of illegal and criminal activities by terrorists, cybercriminals, spies, and offenders. Identifying actions, products, and offenders on the Dark Web is challenging due to its size, intractability, and anonymity. Therefore, it is crucial to intelligently enforce tools and techniques capable of identifying the activities of the Dark Web to assist law enforcement agencies as a support system. Therefore, this study proposes four deep learning architectures (RNN, CNN, LSTM, and Transformer)-based classification models using the pre-trained word embedding representations to identify illicit activities related to cybercrimes on Dark Web forums. We used the Agora dataset derived from the DarkNet market archive, which lists 109 activities by category. The listings in the dataset are vaguely described, and several data points are untagged, which rules out the automatic labeling of category items as target classes. Hence, to overcome this constraint, we applied a meticulously designed human annotation scheme to annotate the data, taking into account all the attributes to infer the context. In this research, we conducted comprehensive evaluations to assess the performance of our proposed approach. Our proposed BERT-based classification model achieved an accuracy score of 96%. Given the unbalancedness of the experimental data, our results indicate the advantage of our tailored data preprocessing strategies and validate our annotation scheme. Thus, in real-world scenarios, our work can be used to analyze Dark Web forums and identify cybercrimes by law enforcement agencies and can pave the path to develop sophisticated systems as per the requirements.

In the Name of Dark Web Justice: A Crime Script Analysis of Hacking Services and the Underground Justice System

The Dark Web serves as a key venue for peddling illegal goods and services, from stolen possessions and drugs to illicit activities. The concurrent increase in Tor network usage and the development of cryptocurrency has led to the creation of major black market sites. One of the most popular illicit services offered on the Dark Web is hacking, which includes website/social media account hacking, Denial-of-service attacks, and custom malware. At the same time, the Dark Web community has formed its own justice system leveraging the layer of anonymity that exists between underground community users and the cybercrime ecosystem. Existing studies predominantly focus on the major drug market operating on the Dark Web, firearm sales, sexual exploitation, and money laundering. To address the gaps in the current research as well as the relative nascency of an underground justice system to monitor hacking services on the Dark Web, this study attempts to broadly capture the dynamic nature of hacking services, which requires continuous research to identify new trends and develop effective responses. The study aims to examine the characteristics and the operations of the hacking service market and the underground justice system on the Dark Web via an in-depth examination of Dark Web forums with a crime script analysis vis-à-vis thematic analysis. The study defines the crime script as that which includes pretrial, mid-trial, finalization, and exit stages. This research sheds light on Dark Web justice courts’ procedures and the courts’ implications for shaping the future of the Dark Web.

S.U.S. You’re SUS!—Identifying influencer hackers on dark web social networks

Dark web is an obscured part of the Internet, specifically used for sharing exploits, data breaches, and other means of cybercrime. Dark web forums provide opportunities to share such data and exploits and assign user reputation and credibility through participation in discussions and sharing data, exploits, and hacks. Such activities can help develop metrics to enable identification of influential mal-actors facilitating efficient and effective defense against emerging cyber threats, particularly zero-day exploits. This paper proposes an AI-inspired framework to identify influencers on dark web social networks (INSPECT) through intelligent analysis of user-profiles, interactions, and other activities. INSPECT framework leverages Feature Engineering, Social Network Analysis, Semantic Analysis, and K-means clustering and calculates an influencer score representing the users’ significance within these forums. INSPECT has been evaluated using CrimeBB dataset comprising user profiles and activities within dark web forums to assess its effectiveness in identifying influential users on the dark web forums.

Обеспечение экономической безопасности при утечке конфиденциальной информации

The relevance of countering the leakage of confidential information in connection with the active digitalization of management processes, the digital economy, and the expansion of remote work has been identified. The emergence and expansion of a new type of rent - confidential information is indicated. Tendencies in the field of leakage of confidential information have been established. The concept of information leakage is given and leakage schemes are modeled. The change in the structure of the impact on information resources is analyzed. The factors of intentional leaks of confidential information are systematized. The classification of losses from leaks of confidential information is carried out. The Dark web forum for selling confidential information is described. The branches and divisions of confidential information leakage are analyzed. A chronological analysis of state structures exposed to the leakage of confidential information was carried out. The international experience in countering the leakage of confidential information is presented. A comparative analysis of the leakage of confidential information in Russia and in the countries of the world by industry, size of organizations, and the nature of information has been carried out.

Patient personal data protection: comparing the health-care regulations in Indonesia, Singapore and the European Union

PurposeThis paper aims to identify the reasons why cases of leakage of patient personal data often occur in the health sector. This paper also analyzes personal data protection regulations in the health sector from a comparative legal perspective between Indonesia, Singapore and the European Union (EU).Design/methodology/approachThis type of research is legal research. The research approach used is the statute approach and conceptual approach. The focus of this study in this research is Indonesia with a comparative study in Singapore and the EU.FindingsCases of leakage of patient personal data in Indonesia often occur. In 2021, the data for 230,000 COVID-19 patients was leaked and sold on the Rapid Forums dark web forum. A patient’s personal data is a human right that must be protected. Compared to Singapore and the EU, Indonesia is a country that does not yet have a law on the protection of personal data. This condition causes cases of leakage of patients’ personal data to occur frequently.Research limitations/implicationsThis study analyzes the regulation and protection of patients’ personal data in Indonesia, Singapore and the EU to construct a regulatory design for the protection of patients’ personal data.Practical implicationsThe results of this study are useful for constructing regulations governing the protection of patients’ personal data. The regulation is to protect the patient’s personal data like a patient’s human right.Social implicationsThe ideal regulatory design can prevent data breaches. Based on the results of comparative studies, in Singapore and the EU, cases of personal data leakage are rare because they have a regulatory framework regarding the protection of patients’ personal data.Originality/valueLegal strategies that can be taken to prevent and overcome patient data breaches include the establishment of an Act on Personal Data Protection; the Personal Data Protection Commission; and management of patients’ personal data.

Exploring the Dark Web for Cyber Threat Intelligence

Cyber attack strategies have become more prominent in recent years, making it more difficult to stop an assault, even if some form of countermeasure is used. Even with protection systems in place, it is challenging to totally avoid all cyber intrusions. We are, in a sense, in a defense-only posture. A strategy for exploiting this threat will be provided, which will combine social network analysis with cognitive computing to filter hostile behavior and forecast their vulnerabilities. The major goal is to harvest crucial postings from dark web forums, including posts from malicious hackers, and disseminate information like virus trading and hacking strategies. Hence ,We are proposing an approach to extract forums which include important information or intelligence and identify traits of each forum using AI and ML Techniques. Information gathering from the dark-web communities is quite a challenging task, data cannot address real-world cybersecurity problems considering the importance of information gathering. The dataset containing forum posts from the darknet were extracted from different websites using different web crawlers .Then the retrieved data is cleaned , normalized, parsed, processed and classified and labeled according to their severity. After this phase different ML algorithms were applied on labeled data . Finally the model is tested with the inputs and used for predicting the cyber threats for future. The main focus of this research will assist us in identifying future developing risks in cyberspace and high propensity measures to counter such malicious tasks. With recent technological advancements, recent research has revealed that dark-web indications may be connected with event data and leveraged to forecast intrusions, indicating perhaps a more threat-focused cybercrime is on the horizon. Keywords—Intelligence, Darkweb, Forums, Machine Learning

ChunkedHCs algorithm for authorship verification problems: Reddit case study

Cybercrime can be associated with undisclosed social media accounts deliberately used to conduct unethical or illegal activities such as cyberbullying, fraudulent transactions, human trafficking, etc. The objective of this paper is to identify whether two social media accounts belong to the same person by examining the accounts' writing, i.e. comments and posts. To that end, this preliminary study introduces a new algorithm, ChunkedHCs, specifically designed for the authorship verification task to decide whether a pair of texts are written by the same person. In the domain of machine learning and deep learning, there have been previous authorship verification approaches, which often involve complex feature selections or sophisticated pre-processing steps due to the complexity of topic heterogeneity. Such limits provide motivations to seek a simpler yet more robust approach that could offer competitive verification ability. ChunkedHCs is based on the statistical testing Higher Criticism (Donoho and Jin, 2004) and the HC-based similarity algorithm (Kipnis, 2020a & 2020b) (Kestemont et al., 2020). Using Reddit users’ data, ChunkedHCs offer a promising performance with an accuracy of 0.94 and an F1 of 0.9381 for texts between 29,000 and 30,000 characters. It is speculated that the algorithm could also be highly applicable to identify if two accounts are used by the same person for other social media platforms such as Facebook, Twitter and even dark web forums. Various avenues of further research on ChunkedHCs are also proposed.

Detecting online recruitment of terrorists: towards smarter solutions to counter terrorism

Increased usage of social media led to formation of online communities of terrorist groups for discussing many violent plans. These online communities present big data to researchers to identify hidden patterns and behaviors to generate actionable intelligence which can be useful for security agencies. Recruiting new people over online social media is on emerging trend which presents how internet is exploited by terrorist groups. In this paper, we present automatic model to detect online cyber recruitment over social media. Online discussions regarding recruitment of terrorists or building new connections for recruitment of violent extremist have been labelled. Two experts labelled 730 messages from five dark web discussion forums named ‘Ansar1’, ‘Gawaher’, ‘Islamic Awakening’, ‘Islamic Network’ and ‘Mywic’ as YES (recruitment) and NO (non-recruitment). Statistical analysis has been done on two independent labelled messages to find mutual agreement between two judges. Kohen’s Kappa coefficient computed is 0.87 at p = 0.01 which signifies higher mutual agreement. Five machine learning classifiers namely support vector machine, logic boosting, random forest, generalized linear model and maximum entropy based model are developed to further classify recruitment labels. To the best of our knowledge no such work has been done by collaborating data from multiple dark web discussion forums to automatic identify online recruitment of terrorists. Our proposed model presents smart solution with usage of computational techniques to quantify terrorist behavior analysis and detect online recruitment of violent extremists over online social media and dark web forums.

An Unsupervised Model for Identifying and Characterizing Dark Web Forums

Dark Web forums are significantly exploited to trade confidential information and illicit products by criminals. This paper addresses the problem of how to identify the cluster of discussion forums and their characteristics on the Dark Web. Exiting methods are mostly dependent on the continuous labeled contents, which are expensive and not feasible due to the nature of Dark Web data. Therefore, an approach that does not need a continuous availability of labeled forum and related knowledge is required. To this end, we propose an unsupervised model to identify and characterize Dark Web forums by combining clustering algorithm and decision tree algorithm. The proposed method presents the characteristics in an explainable form that can be used by the cyber threat intelligence system and law enforcement as scientific evidence to analyze any data breach or illicit activities in the Dark Web forums. To evaluate the performance of our model comprehensive experiments were conducted using real Dark Web forum data. The proposed approach achieves 98% accuracy and F1 score of 98% validating the efficacy of our proposed model to successfully characterize Dark Web forums. The experimental results suggest that the proposed model could be useful to the cyber threat intelligence and law enforcement community for building an intelligent source of knowledge that can be used for detecting data breach and illicit activities happening in the Dark Web forums.

Mining user interaction patterns in the darkweb to predict enterprise cyber incidents

With the rise in security breaches over the past few years, there has been an increasing need to mine insights from social media platforms to raise alerts of possible attacks in an attempt to defend conflict during competition. In this study, we attempt to build a framework that utilizes unconventional signals from the darkweb forums by leveraging the reply network structure of user interactions with the goal of predicting enterprise-related external cyber attacks. We use both unsupervised and supervised learning models that address the challenges that come with the lack of enterprise attack metadata for ground-truth validation as well as insufficient data for training the models. We validate our models on a binary classification problem that attempts to predict cyber attacks on a daily basis for an organization. Using several controlled studies on features leveraging the network structure, we measure the extent to which the indicators from the darkweb forums can be successfully used to predict attacks. We use information from 53 forums in the darkweb over a span of 17 months for the task. Our framework to predict real-world organization cyber attacks of three different security events suggests that focusing on the reply path structure between groups of users based on random walk transitions and community structures has an advantage in terms of better performance solely relying on forum or user posting statistics prior to attacks.

Differences in structure and dynamics of networks retrieved from dark and public web forums

Humans make decisions based on the information they obtain from several major sources, among which the comments of others in Internet forums play an increasing role. Such forums cover a wide spectrum of topics and represent an essential tool in choosing the best products, manipulating views or optimizing our decisions regarding a number of aspects of our everyday life. However, many forums have extremely controversial topics and contents including those which radicalize the readers or spread information about dangerous products and ideas (e.g., drugs, weapons or aggressive ideologies). These just mentioned activities are taking place mainly on the so called “dark web” allowing the hiding of the identity of members using dark forums. We use network theoretical approaches to analyze the data we obtained by studying the connectivity features of the members and the threads within a wide selection of forums (including dark and semi-dark) and establish several characteristic behavioral patterns. Our findings reveal both common and rather different features in the two types of behavior. In particular, we show that the various distributions of quantities, like the activity of the commenters, the dynamics of the threads (defined using their lifetime) or the degree distributions corresponding to the three major types of forums we have investigated display characteristic deviations. This knowledge can be useful, for example, in identifying an activity typical for the dark web when it appears in the public web (since the public web can be accessed and used much more easily).

A Comparative Study and Automated Detection of Illegal Weapon Procurement over Dark Web

Terrorist groups have reconnoitered smarter ways to use online discussion forums for their violent plans. They have been using their privately owned discussion forums for various illegal purposes. A comparative study of work done on various dark web forums of terroristic organizations is done in this paper. This paper proposes a novel approach to identify procurement of modern weapons over the social media forum by terrorist groups. We used data from four dark web forum websites named “Ansar Aljihad Network”, “IslamicAwakening”, “Gawaher”, and “IslamicNetwork”. Multiple experts independently annotated 313 randomly selected posts as procurement (YES) or non- procurement (NO) to label the forum threads. Mutual agreement between experts is computed to find the level of significance. Furthermore, we used machine learning classification techniques (MLCT) in order to classify labeled posts. To our knowledge, our procurement model presents a first of its kind model to automatically detect procurement of modern weapons over dark web. The work done presents application of social media analytics and text mining to counter terrorism.

Approaches to Detect Online Radicalization: A Survey

Approaches to Detect Online Radicalization: A Survey

Hybridized term-weighting method for Dark Web classification

The role of intelligence and security informatics based on statistical computations is becoming more significant in detecting terrorism activities proactively as the extremist groups are misusing many of the obtainable facilities on the Internet to incite violence and hatred. However, the performance of statistical methods is limited due to the inadequate accuracy produced by the inability of these methods to comprehend the texts created by humans. In this paper, we propose a hybridized feature selection method based on the basic term-weighting techniques for accurate terrorism activities detection in textual contexts. The proposed method combines the feature sets selected based on different individual feature selection methods into one feature space for effective web pages classification. UNION and Symmetric Difference combination functions are proposed for dimensionality reduction of the combined feature space. The method is tested on a selected dataset from the Dark Web Forum Portal and benchmarked using various famous text classifiers. Experimental results show that the hybridized method efficiently identifies the terrorist activities content and outperforms the individual methods. Furthermore, the results revealed that the classification performance achieved by hybridizing few feature sets is relatively competitive in the number of features used for classification with higher hybridization levels. Moreover, the experiments of hybridizing functions show that the dimensionality of the feature sets is significantly reduced by applying the Symmetric Difference function for feature sets combination.