Multilayer Analysis of Online Illicit Marketplaces

The content of Online Illicit Marketplaces (OIMs) on the Dark Web has been studied using different approaches. For example, qualitative ethnographic studies to understand the markets' social dynamics have produced interesting descriptions of specific sites, contexts and behaviours [1], but given the large amount of data exchanged on several markets a manual qualitative analysis can only provide a partial view of these systems. Therefore, more quantitative approaches have been used (e.g., to provide an overview of the exchanges and social dynamic within the Silk Road OIM [2]), and to classify the information exchanged online (e.g., clustering forum posts depending on the function of the post or the type of drug [3]). These quantitative methods can scale to larger datasets, but they cannot extract the rich behavioural information that can be obtained through manual inspection of the data. In this poster we show our experience combining both, statistical inference methods and blockmoldeing techniques approaches, into a single analysis pipeline able to provide a more complete understanding of the social dynamics occurring on these types of online participatory forums. The results are based on our experimental analysis performed on a Silk Road OIM dataset, including 239 megabytes of data containing roughly more than 26,190 conversations across 17 different categories or subforums. First, we describe how the annotated posts can be combined to generate a multilayer network [4] where each operational category is represented by a different layer, enriched with textual information. The main difficulties in building such abstraction concern the temporal nature of participatory forums and missing data from encrypted content. This leads to a large complex structure where relevant information is not easily distinguishable from noise, but also allowing the application of a plethora of analytical techniques. Therefore, the poster intends to provide some schematic guidelines to help others to deal with this enriched abstraction of a participatory forum supporting an OIM. We will first discuss how preprocess the multilayer graph using statistical inference to reduce the complexity of the structure. In particular, we have manually divided the subforums based on their categories and reported which ones foster the emergence of a collective phenomena by checking the temporal formation of ties between members. The participation pattern indicates that users tend to participate first, but not much, in subforums directly related with the dark market, and only afterwards they start interacting with prominent users in other subforums. Therefore, we applied different block-modeling methods only in the later group of categories, where the social relations are more stable and a sense of community is expected. This is important, as the ultimate goal of the applied blockmodeling methods is to identify users interacting between and within specific communities of participants. We also believe that the methods and lessons described in the poster could be of interest on understanding other social participatory forums with a similar structure, even if not strictly focused on illicit activities.