Source-linked AI summary
Darknet and Deepnet Mining for Proactive Cybersecurity Threat Intelligence
Eric Nunes, Ahmad Diab, Andrew Gunn, Ericsson Marin, Vineet Mishra, Vivin Paliath, John Robertson, Jana Shakarian, Amanda Thart, Paulo Shakarian
TL;DR
The paper addresses the need to identify emerging cyber threats before malicious parties interact with defended systems by mining darknet and deepnet marketplaces and forums. It develops an operational intelligence-gathering system using focused crawling, data mining, and machine learning, collecting approximately 305 threats weekly while recalling 92% of relevant marketplace products and 80% of relevant forum discussions.
Problem
Pre-reconnaissance threat intelligence is needed to identify vulnerabilities, exploits, and malicious-hacking information before attackers interact with defended systems.
Method
The paper builds an operational system that collects data from darknet and deepnet markets and forums, using focused crawling and supervised or semi-supervised classification with character n-gram features.
Results
The system collects approximately 305 cyber threats weekly, recalls 92% of relevant marketplace products at 82% precision, recalls 80% of relevant forum discussions at 78% precision, and detected 16 zero-day exploits over four weeks.
Takeaways & Limitations
The collected intelligence supports security professionals in identifying emerging cyber threats and capabilities and aids analysis of malicious-hacker networks across markets and forums.
Abstract
from arXiv · showhide
In this paper, we present an operational system for cyber threat intelligence gathering from various social platforms on the Internet particularly sites on the darknet and deepnet. We focus our attention to collecting information from hacker forum discussions and marketplaces offering products and services focusing on malicious hacking. We have developed an operational system for obtaining information from these sites for the purposes of identifying emerging cyber threats. Currently, this system collects on average 305 high-quality cyber threat warnings each week. These threat warnings include information on newly developed malware and exploits that have not yet been deployed in a cyber-attack. This provides a significant service to cyber-defenders. The system is significantly augmented through the use of various data mining and machine learning techniques. With the use of machine learning models, we are able to recall 92% of products in marketplaces and 80% of discussions on forums relating to malicious hacking with high precision. We perform preliminary analysis on the data collected, demonstrating its application to aid a security expert for better threat analysis.
I. INTRODUCTION
The paper develops pre-reconnaissance cyber threat intelligence from darknet and deepnet markets and forums to identify emerging malicious hacking threats before attacks. Its operational system supports security professionals with collected warnings, targeted questions, learning-based filtering, and case studies.
- Motivation: Pre-reconnaissance cyber threat intelligence is gathered before a malicious party interacts with a defended computer system.The paper illustrates its value through an exploit that appeared for sale before its first reported use in an attack.
- Operational scope: The system collects approximately 305 cyber threats each week from darknet and deepnet markets and forums.The collected information includes data related to malicious hacking, while vendor and user statistics focus on participants associated with such material.
- Analytical goals: Threat intelligence supports questions about cross-platform participants, zero-day exploits under development, and vulnerabilities targeted by current exploits.These questions are framed for strategic cyber-defense planning by security professionals.
- Contributions: The paper contributes a threat-intelligence gathering system, learning models for separating relevant information from noise, and case studies of malicious hacker behavior.The contributions cover data collection, model implementation and evaluation, and analysis of findings from the operational system.
- Terminology and sources: Darknet denotes anonymous communication through crypto-networks such as Tor, whereas deepnet denotes open-Internet websites not indexed by search engines.Tor obscures traffic analysis by routing encrypted information through volunteer-operated nodes.
- Data sources: Darknet marketplaces sell diverse goods and services, and only 13% of the collected products concern malicious hacking.Vendors also advertise products on forums, linking marketplace activity with forum-based communication.
II. SYSTEM OVERVIEW
The system combines human discovery, platform-specific crawling, and parsing to gather cyber threat intelligence from darknet and deepnet forums and marketplaces. Its components address different platform structures and access-control conditions before integration.
- Platform discovery: Human analysts use search engines, Tor spider services, and links posted on Tor-network or Clearnet forums to find malicious-hacker forums and marketplaces.The discovered platforms populate the system's collection scope.
- Crawler: Separate crawlers retrieve products from markets and discussions from forums while addressing inaccessible servers, unresponsive services, and repeating links.The crawlers are designed separately because markets and forums differ structurally and in their access-control measures.
- Integration: The system integrates independently built modules and actively collects cyber threat intelligence for a database intended for security professionals.The described system includes crawler and parser components developed before integration.
III. EVALUATION
The evaluation frames marketplace-product and forum-topic filtering as binary classification problems: identifying whether collected items contain communication relevant to malicious hacking.
- Classification task: The evaluation classifies marketplace products and forum topics as relevant or not relevant to malicious hacking.The classified samples are products or forum topics collected from darknet and deepnet platforms.
- Evaluation design: The study evaluates both supervised and semi-supervised approaches for identifying relevant products and forum topics.This setup addresses the classification task across the two source types.
A. Machine Learning Approaches
The paper combines supervised classifiers with semi-supervised methods to reduce reliance on labeled data. It describes label propagation and co-training, with parameter selection performed through grid search.
- Supervised learning: Supervised methods include Naive Bayes, random forest, support vector machine, and logistic regression, but they require labeled data.The paper notes that obtaining labeled data is expensive and often requires expert knowledge.
- Semi-supervised learning: Semi-supervised methods leverage unlabeled data when only limited labeled data are available.The paper uses these methods alongside supervised classifiers for the classification task.
- Model selection: Grid search is used to find optimal parameters for the learning techniques.The paper applies this tuning step within its comparison of supervised and semi-supervised approaches.
- Label propagation: Label propagation estimates labels for unlabeled samples using a weighted similarity graph with a labeled subset.The graph represents samples as vertices and similarities as weighted edges.
- Co-training: Co-training divides features into two sets, trains two classifiers on labeled data, and exchanges high-confidence estimates for unlabeled points.The two classifiers iteratively augment one another's labeled sets.
B. Experiments: Marketplaces
The marketplace experiment classifies products as relevant or irrelevant to malicious hacking despite noisy data and limited labeled examples. Supervised and semi-supervised models, supported by text preprocessing, are evaluated across 10 marketplaces.
- Data and preprocessing: 13% of marketplace products relate to malicious hacking, making classification necessary to separate relevant products from noisy, non-relevant listings.Marketplace data includes goods and services such as drugs, pornography, weapons, and software services.
- Data and preprocessing: Text cleaning and stop-word removal greatly improved classification performance.The cleaning removed non-alphanumeric characters from product titles and descriptions.
- Data and preprocessing: Character n-grams in the range (3, 7) outperformed word stemming by handling misspellings and word variations.Shared character features can represent related or misspelled forms such as hacker, hackz, and hackker.
- Experimental setup: 25% of products from each marketplace were labeled by security experts, while semi-supervised training additionally used 75% unlabeled marketplace data.Manual labeling takes approximately one minute for five marketplace products.
- Results: 87% recall was achieved by linear-kernel SVM in the supervised experiment, which used 25% labeled data from each marketplace.Performance was evaluated with precision, recall, and unbiased F1 using leave-one-marketplace-out cross-validation across 10 marketplaces.
- Results: 92% recall with 82% precision was achieved by co-training with Linear SVM for relevant products in the semi-supervised experiment.The unlabeled data improved recall without significantly reducing precision.
C. Experiment: Forums
The forum experiment identifies malicious-hacking-related topics among discussions containing 781 topics and 5,373 posts. Semi-supervised co-training improved recall over the best supervised model while maintaining high precision.
- Problem and data: Only a fraction of forum topics contain information relevant to malicious hacking, requiring a classifier to distinguish relevant from irrelevant topics.The classification problem has challenges similar to marketplace product classification.
- Experimental setup: The evaluation used two English forums, 25% labeled topics, and 10-fold cross-validation with supervised and semi-supervised methods.The dataset contained 781 topics and 5,373 posts.
- Results: 80% precision and 68% recall were achieved by logistic regression in the supervised setting.Logistic regression was the best-performing supervised method in the reported comparison.
- Results: 80% recall with 78% precision was achieved by co-training with logistic regression in the semi-supervised setting.The authors report improved recall while maintaining precision when unlabeled data was leveraged.
IV. CASE STUDIES
The case studies analyze collected data using security terminology to examine questions raised earlier in the paper. They define vulnerability, exploit, and patch before presenting findings.
- Security terms: A vulnerability is a security flaw that allows an attacker to compromise software or an operating system.
- Security terms: An exploit is software that takes advantage of a vulnerability to compromise software or an operating system.
- Security terms: A patch is software used to improve existing software by fixing vulnerabilities and improving security.
A. Discovery of Zero-Day Exploits.
Marketplace monitoring detected zero-day exploits before or during their sale, providing concrete cases for early cyber threat intelligence. The findings connect exploit detection with possible prioritization of defensive actions.
- Findings: 16 zero-day exploits were detected from marketplace data over a 4 week period.The paper defines zero-day exploits as leveraging vulnerabilities unknown to the vendor.
- Example case: The Android WebView zero-day affected Android 4.3 Jelly Bean or earlier and continued to be sold after patches for later versions were released.The paper reports that these versions comprised more than 60% of Android devices in 2015.
- Defensive relevance: Earlier detection can help organizations avoid an attack or minimize damage by prioritizing patching, updating, or replacing affected systems.This defensive response is illustrated using systems running the Android operating system.
B. Users having presence in markets/ forums.
The paper integrates marketplace and forum identities into a cross-site social network to study previously unexamined connections among malicious hackers. This reveals patterns of multi-platform participation and vendor activity.
- The system creates a connected graph linking marketplace and forum users through their usernames, enabling analysis of cross-site connections.
- Most users belong to only one market or forum, while 751 users appear on more than two platforms.
- The presence of users across multiple markets and forums follows a power-law distribution.
- One vendor is active in 7 marketplaces and 1 forum, offering 82 malicious-hacking-related products and discussing them on the forum.
- Integrated network representations help associate individuals across domains and support analysis of social groups within forums.
V. RELATED WORK
Prior work uses web crawling and analysis to collect threat-related information, but much of it focuses on the surface web or a single darknet domain. The paper builds on this literature by addressing both forums and marketplaces.
- Web crawling is widely used to collect large amounts of Internet data, often requiring topic-based focused crawlers for specific applications.
- Most focused crawlers target the surface web, while newer work has concentrated on collecting data from dark web forums.
- Previous darknet-crawling studies primarily explore forums as a single domain.
- Related research analyzes exploit information and hacker forums to support cyber-risk assessment and threat detection.
VI. CONCLUSION
The paper implements an operational intelligence-gathering system focused on malicious hacking across darknet and deepnet social platforms. Its database is intended to help security professionals identify emerging cyber threats and capabilities.
- The operational system gathers intelligence about malicious hacking from social platforms on the darknet and deepnet.
- The system addresses design challenges in focused crawling through data mining and machine learning techniques.
- The resulting database is made available to security professionals for identifying emerging cyber threats and capabilities.