HC-HackerRank: Identifying Key Hackers in Cybercrime Social Network Forums

Abstract

Underground forums are a refuge for malicious activities, emphasizing anonymity while circumventing conventional online oversight. Within the murky depths of these forums, cybercriminals gather to exchange illicit knowledge, tools, and tactics, fueling a spectrum of cyber threats ranging from hacking techniques to the distribution of stolen data, malware, and zero-day exploits. Identifying the key instigators, particularly key hackers driving these activities, is essential but remains a significant challenge. In this paper, we propose Hybrid Centrality Hacker Rank (HC-HackerRank), an automated system designed to identify key hackers within underground social network forums. Our system analyzes user profiles, interactions, and activities to determine user influence. The process begins with a comprehensive evaluation of cybercrime subforums, extracting users’ topic preferences through topic modeling. This approach highlights each user’s expertise and interests, allowing us to remove those with no technical skills, and focus on presumed skilled cybercriminals. Additionally, we apply multiple centrality measures and an influencer score to rank each user. The framework was applied to the Hack-Forums dataset, followed by an in-depth manual analysis of the identified key hackers. The results of our approach demonstrate its effectiveness in identifying key hackers in underground forums.