Repository logo

Characterizing eve: Analysing cybercrime actors in a large underground forum

Accepted version


Conference Object

Change log


Underground forums contain many thousands of active users, but the vast majority will be involved, at most, in minor levels of deviance. The number who engage in serious criminal activity is small. That being said, underground forums have played a significant role in several recent high-profile cybercrime activities. In this work we apply data science approaches to understand criminal pathways and characterize key actors related to illegal activity in one of the largest and longest- running underground forums. We combine the results of a logistic regression model with k-means clustering and social network analysis, verifying the findings using topic analysis. We identify variables relating to forum activity that predict the likelihood a user will become an actor of interest to law enforcement, and would therefore benefit the most from intervention. This work provides the first step towards identifying ways to deter the involvement of young people away from a career in cybercrime.



Cybercrime, Underground forums, Social behaviour, Criminal pathways

Journal Title

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Conference Name

RAID 2018: 21st International Symposium on Research in Attacks, Intrusions, and Defenses

Journal ISSN


Volume Title

11050 LNCS


Springer International Publishing
Engineering and Physical Sciences Research Council (EP/M020320/1)
Alan Turing Institute (DS_SDS_1718_4)
Alan Turing Institute