“Tokyo, Denver, Helsinki, Lisbon or the Professor? A Framework for Understanding Cybercriminal Roles in Darknet Markets”, Claudia Peersman, Denny Pencheva, Awais Rashid2021-12 (DNM Archives)⁠:

There is comparatively little information about the roles and the separation of these roles within financially-motivated cybercrime online. As Darknet Markets (DNMs) are online fora, roles can often be conflated with membership or user types within such fora, eg. administrator, new user, etc.

The insights presented in this paper are grounded in a Conversation Analysis of underground forum threads in combination with Social Network Analysis of the relationships between actors in these fora and an automated analysis of the thematic scope of their communications using NLP techniques. This results in a more nuanced understanding of roles, and the power relationships between roles, as they emerge through and are defined by linguistic interactions.

Based on this mixed methods approach, we developed a dynamic typology of 3 key roles within DNMs that goes beyond a basic supply-demand logic: ‘entrepreneurs’, ‘influencers’ and ‘gatekeepers’.

A closer analysis of these roles can contribute to a better understanding of emerging trends in a forum and allow for the identification and prioritization of high-risk targets.

… In this paper, we combine a qualitative analysis with novel techniques in the area of Natural Language Processing (NLP) and Social Network Analysis (SNA), enabling a corpus-based approach that incorporates all users and their communications in Darknet fora. More specifically, the key contributions of this study are as follows:

1. We construct a weighted undirected network to model interactions between users of the Evolution forum, which acted as support area for the Evolution marketplace, one of the largest drug markets in 2014. Our analysis includes over 500,000 messages posted by over 21,000 users.

2. We present a dynamic typology, which goes beyond a basic supply-demand logic (cf. §II). More specifically, we provide an in-depth and qualitatively interesting understanding of roles and power relations between roles as they emerge through and are defined by linguistic interactions between Evolution forum members. This focus on developing a qualitative systematic view of different roles in financially-motivated cybercriminal Darknet communities, rather than taking a one-dimensional focus on a quantitative evaluation of the methods presented, is often lacking in prior work in this area.

3. We describe a novel unsupervised learning methodology to automatically categorise offenders within this dynamic role typology, which allows for cybercriminal forums and marketplaces to be subdivided into usefully-delineated sub-communities, and for identifying key users playing prominent roles in these communities.

We demonstrate the feasibility of automatically detecting the thematic scope of cyber offender communications, despite the challenges associated with this type of text.

…§III. Data: A. Overview: For this analysis, we make use of the DNM Corpus: a large dataset collected 2013^–₂2015 and publicly available. In particular, we targeted a discussion forum within this collection, the Evolution forum, which acted as support area for the eponymous underground marketplace dealing in a number of different illicit goods, especially drugs.

Evolution was active between 14 January 2014 and March 2015²⁹. Its popularity increased during Operation Onymous, potentially because it was not part of this investigation³⁰. Additionally, Evolution was labeled as one of the two largest drug markets in November 2014,³¹ and it had earned a reputation of being a secure, professional and reliable marketplace with a high up-time rate³². However, in mid-March, all escrow accounts were frozen by its administrators, claiming technical issues, and the site was shut down. This exit scam resulted in the theft of ~$16.03^$12₂₀₁₄ million in bitcoins Evolution was holding as escrow³³.

The Evolution forum dataset contains 509,225 messages written by 21,946 different users in total, with on average 23.2 messages per user and 53.1 tokens per message. Each individual in the dataset contributed to on average 11.3 different threads.