عنوان

Dark Vendor Profiling

TLpq2411522498

انگلیسی

Dark Vendor Profiling

[Thesis]

Jeziorowski, Susan

Siraj, Ambareen

Tennessee Technological University

2020

124

M.S.

Tennessee Technological University

2020

Tor hidden services and anonymity tools alike provide an avenue for cyber criminals to conduct illegal activities online without fear of consequences. In particular, dark marketplaces are hidden services that enable the trade of paraphernalia such as drugs, weapons, malware, counterfeit identities, and pornography among other items of criminal nature. Several effective Dark Web analysis techniques have been proposed for Dark Web Forums and primarily focus on authorship analysis where the goal is one of two tasks: (a) user attribution, where a user is profiled and identified given an artifact they own, and (b) alias attribution, where pairs of users are identified to belong to the same individual. While these techniques may support dark web investigations and help to identify and locate perpetrators, existing automated techniques are predominately forum-based and stylometry-based, leaving non-textual artifacts, such as images, out of consideration due to the illicit nature of dark marketplace listings. Thus, new methodologies for adequate evidence collection and image handling in dark marketplaces are essential. In this thesis, stylometric, image, and attribute-based artifacts are collected from 25 dark marketplaces and machine learning based Dark Vendor Profiling methodologies are proposed to achieve dark vendor attribution and alias attribution across dark marketplaces, thereby supporting investigative efforts in deanonymizing cyber criminals acting on the anonymous web. Namely, we first propose the collection of image hashes in place of image content to reduce the storage demands of our proposed technique and reduce the risk of obtaining illicit digital material during data collection. Second, we design two unique feature sets for authorship analysis tasks that are extracted per listing and per vendor. Third, we propose a novel application of the Random Forest machine learning technique for the task of vendor attribution in dark marketplaces, achieving over 90% accuracy in distinguishing between over 2,500 unique dark vendors from various marketplaces. Lastly, we propose a novel application of the Record Linkage technique for the task of alias attribution and obtain imperative preliminary observations from Support Vector Machine and Logistic Regression based models that can assist in the design of future alias attribution models. Therefore, this thesis presents a detailed description of these contributions along with an evaluation of our proposed Dark Vendor Profiling system and several future research directions.

Computer science

Criminology

Jeziorowski, Susan

Siraj, Ambareen

p

[Thesis]

276903

a

Y