SYSML: StYlometry with Structure and Multitask Learning: Implications for Darknet Forum Migrant Analysis

Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 6844–6857 November 7–11, 2021. c⃝2021 Association for Computational Linguistics 6844 SYSML: StYlometry with Structure and Multitask Learning: Implications for Darknet Forum Migrant Analysis Pranav Maneriker Yuntian He Srinivasan Parthasarathy The Ohio State University {maneriker.1@,he.1773,parthasarathy.2}@osu.edu Abstract Darknet market forums are frequently used to exchange illegal goods and services between parties who use encryption to conceal their identities. The Tor network is used to host these markets, which guarantees additional anonymization from IP and location tracking, making it challenging to link across malicious users using multiple accounts (sybils). Addi- tionally, users migrate to new forums when one is closed further increasing the difficulty of linking users across multiple forums. We develop a novel stylometry-based multitask learning approach for natural language and model interactions using graph embeddings to construct low-dimensional representations of short episodes of user activity for authorship attribution. We provide a comprehensive eval- uation of our methods across four different darknet forums demonstrating its efficacy over the state-of-the-art, with a lift of up to 2.5X on Mean Retrieval Rank and 2X on Recall@10. 1 Introduction Crypto markets are “online forums where goods and services are exchanged between parties who use digital encryption to conceal their identi- ties” (Martin, 2014). They are typically hosted on the Tor network, which guarantees anonymization in terms of IP and location tracking. The iden- tity of individuals on a crypto-market is associated only with a username; therefore, building trust on these networks does not follow conventional mod- els prevalent in eCommerce. Interactions on these forums are facilitated by means of text posted by their users. This makes the analysis of textual style on these forums a compelling problem. Stylometry is the branch of linguistics concerned with the analysis of authors’ style. Text stylometry was initially popularized in the area of forensic lin- guistics, specifically to the problems of author pro- filing and author attribution (Juola, 2006; Rangel et al., 2013). Traditional techniques for author- ship analysis on such data rely upon the existence of long text corpora from which features such as the frequency of words, capitalization, punctuation style, word and character n-grams, function word usage can be extracted and subsequently fed into any statistical or machine learning classification framework, acting as an author’s ‘signature’. How- ever, such techniques find limited use in short text corpora in a heavily anonymized environment. Advancements in using neural networks for char- acter and word-level modeling for authorship at- tribution aim to deal with the scarcity of easily identifiable ‘signature’ features and have shown promising results on shorter text (Shrestha et al., 2017). Andrews and Witteveen (2019) drew upon these advances in stylometry to propose a model for building representations of social media users on Reddit and Twitter. Motivated by the success of such approaches, we develop a novel methodology for building authorship representations for posters on various darknet markets. Specifically, our key contributions include: First, a representation learning approach that cou- ples temporal content stylometry with …

Content truncated to 500 words