Repository logo
 

Automatically identifying the function and intent of posts in underground forums

Published version
Peer-reviewed

Loading...
Thumbnail Image

Type

Article

Change log

Authors

Pastrana, S 
Buttery, PJ 

Abstract

The automatic classification of posts from hacking-related online forums is of potential value for the understanding of user behaviour in social networks relating to cybercrime. We designed annotation schema to label forum posts for three properties: post type, author intent, and addressee. The post type indicates whether the text is a question, a comment, and so on. The author’s intent in writing the post could be positive, negative, moderating discussion, showing gratitude to another user, etc. The addressee of a post tends to be a general audience (e.g. other forum users) or individual users who have already contributed to a threaded discussion. We manually annotated a sample of posts and returned substantial agreement for post type and addressee, and fair agreement for author intent. We trained rule-based (logical) and machine learning (statistical) classification models to predict these labels automatically, and found that a hybrid logical–statistical model performs best for post type and author intent, whereas a purely statistical model is best for addressee. We discuss potential applications for this data, including the analysis of thread conversations in forum data and the identification of key actors within social networks.

Description

Keywords

Cybercrime, Deviant behaviour, Machine learning, Natural language processing, Underground forums

Journal Title

Crime Science

Conference Name

Journal ISSN

2193-7680
2193-7680

Volume Title

7

Publisher

Springer
Sponsorship
Alan Turing Institute (DS_SDS_1718_4)
Engineering and Physical Sciences Research Council (EP/M020320/1)