“Behavioral Profiling of Darknet Marketplace Vendors”, 2020-06-12 (; similar):
The usage and number of darknet users has increased rapidly in recent years. A key reason is that the darknet allows users to be fully anonymous when browsing on the darknet. Though such privacy is needed for some users, others decide to abuse the darknet by selling or buying illicit goods off the darknet marketplace without being arrested or punished. Despite the hidden nature of darknet marketplaces, they oftentimes shut down due to reasons such as law enforcement activities or exit scams. As a result, the average life span of a darknet marketplace tends to be around 8 months. This leads to an important question: If a vendor has built up a good reputation before a darknet was shutdown, does that mean he will start over again from scratch? Not likely. A vendor would most likely use their username as a brand, in order to be recognizable on a different darknet marketplace when others shut down.
This thesis states and explores the hypothesis: Accounts that belong to the same individual are likely to have similar usernames, which are being used as a “brand” by the vendor. To verify this hypothesis, we first devise a method to correlate the accounts in a darknet marketplace data set using their PGP keys, thus linking multiple accounts to a single user. We then devise a method for determining username similarity, and check if the correlated accounts have a username similarity above a certain threshold. These experiments are done both internally within the datasets for the Evolution marketplace and the Silk Road 2 marketplace, and also between the two datasets.
From the experiments, 4 behaviors were identified and they were used to verify and strengthen the hypothesis. Most importantly, we find that two accounts that belong to the same user are likely to have similar usernames if the accounts belong to different marketplaces, but not if the accounts belong to the same marketplace. We thus conclude a modified version of our initial hypothesis: Accounts that belong to the same individual, but are on different marketplaces, are likely to have similar usernames, which are being used as a “Brand” by the vendor.