Decoding the shadows: multi-modal identity profiling in darknet markets using latent behavior feature fusion

Abstract

Abstract The Darknet marketplace, operating on anonymous communication techniques, has become a central hub for illicit trade, enabling elusive vendors to engage in illegal activities. Identifying and profiling these vendors is critical for effective cyberspace governance and combating cybercrime, financial fraud, and other criminal enterprises. However, the inherent anonymity of the Darknet, along with the use of jargon and coded language, presents significant challenges when relying solely on traditional textual features for vendor identification. In this study, we propose a novel vendor profiling approach that integrates latent behavioral features with textual data, forming the Dark Web Latent Behavior Profiling Framework (DarkBIP-FW). This framework uncovers subtle behavioral patterns, such as transaction-related features, vendor posting times, pricing strategies, and product categories, which are crucial for profiling vendors whose activities are often concealed. We introduce a multi-modal feature fusion approach, where latent behavioral features are fused to enhance profiling accuracy, allowing for a deeper understanding of vendor behavior beyond what is conveyed through text alone. Additionally, a multi-label classification loss function, enhanced by label embedding technology, generates unique "fingerprints" for each vendor, further improving classification performance. Our research utilizes the self-constructed DWTFC (Dark Web Chinese Trading Forum Corpus), consisting of over 20,000 product listings, and shows that our method significantly outperforms traditional models in both accuracy and coverage. It also demonstrates superior performance compared to large pre-trained models like GPT-4, especially in identifying high-stickiness vendor groups in Darknet markets. This work offers a comprehensive solution for identifying illicit vendors operating in the Darknet, with strong implications for digital forensics, cybersecurity, and law enforcement, providing new tools to combat cybercrime and uphold the integrity of cyberspace.

Keywords

• Darknet vendor profiling
• Label embedding
• Behavioral features