Multiple threats to the economic and physical well-being of the U.S. may originate from cyberspace, making securing cyberspace and critical infrastructure one of the key strategic goals set by DHS. The HSE requires real-time knowledge of such threats and an in-depth understanding of managing potential disruption strategies in order to effectively execute this critical mission. The results of this project will help inform DHS strategies to respond to cyberthreats in real time and to curb and disrupt the flow of illicit online goods on various darknet market platforms.
Problem addressed
Whereas Darknet markets provide opportunities for expedient acquisition of illegal goods and services, Darknet forums act as a combination of market and exchange boards. They facilitate illegal trade, allow cybercriminals to exchange important information, and promote the creation of criminal networks, thus presenting a significant real-world threat. Understanding the promotion of illicit goods and the potential disruption of illicit exchanges is limited. This project seeks to shed light on the emergence and diffusion of illicit goods on 500+ popular Darknet markets/forums. The study will also examine the evolution of threat actors involved in the production and/or sale of illicit online virtual commodities. The findings of this work will facilitate better understanding of potential disruption strategies to curb threats originating from Darknet forums and markets.
Approach
This project starts by using AI tools to analyze English and non-English-speaking forums and markets that serve as trading places on the Darknet. The researchers then use the digital trace data collected in the first phase to trace the emergence and proliferation of illicit online goods across Darknet trading platforms. The next task develops a web GUI dashboard and AI models for researchers to visualize and predict the diffusion and proliferation of illicit online goods. The researchers will then use the compiled data to examine 300 key online entities. In the final project phase, the research team will investigate the potential effectiveness of a disruption strategies by conducting an anonymous survey of online entities as well as an assessment of forum-based “slander” attacks.
Results
This project will yield four research datasets and corresponding analyses. The first dataset will contain information scraped and parsed from relevant Darknet forums and markets. This dataset will focus on common illicit activities, typical victims, basic market characteristics, and other relevant information. This dataset will also include research findings pertaining to the market disruption/slander attack analysis. The second dataset will extend the first one and will focus on the emergence, diffusion, and proliferation of illicit goods on Darknet markets and forums. The third dataset will be the results of the survey noted above. The fourth dataset will include analysis of online entities to understand their typology and to demonstrate potential future applications for investigators.
Anticipated Impact for DHS
This project will promote the understanding of patterns inherent in Darknet forums/markets as well as possible strategies to destabilize these platforms to disrupt/curb their activity. The data on market/forums will help identify patterns in which illicit goods spread across platforms and linkages between such platforms, and the online entity analysis will reveal the typology, origin, network connections, and significance of entities on Darknet markets/forums. Data on possible ways to taint or “lemonize” markets and forums may be used to develop future strategies to disrupt Darknet marketplaces, and an assessment of possible slander or Sybil attacks may inform future activities aimed at preventing users from engaging with vendors in a specific market.
Research Products:
Presentations: