VendorLink: An NLP approach for Identifying & Linking Vendor Migrants & Potential Aliases on Darknet Markets

Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics Volume 1: Long Papers, pages 8619–8639 July 9-14, 2023 ©2023 Association for Computational Linguistics VendorLink: An NLP approach for Identifying & Linking Vendor Migrants & Potential Aliases on Darknet Markets Vageesh Saxena Law & Tech Lab Maastricht University v.saxena@maastrichtuniversity.nl Nils Rethmeier Speech and Language Technology Lab DFKI, Berlin nils.rethmeier@dfki.de Gijs Van Dijck Law & Tech Lab Maastricht University gijs.vandijck@maastrichtuniversity.nl Gerasimos Spanakis Law & Tech Lab Maastricht University jerry.spanakis@maastrichtuniversity.nl Abstract The anonymity on the Darknet allows vendors to stay undetected by using multiple vendor aliases or frequently migrating between mar- kets. Consequently, illegal markets and their connections are challenging to uncover on the Darknet. To identify relationships between ille- gal markets and their vendors, we propose Ven- dorLink, an NLP-based approach that exam- ines writing patterns to verify, identify, and link unique vendor accounts across text advertise- ments (ads) on seven public Darknet markets. In contrast to existing literature, VendorLink utilizes the strength of supervised pre-training to perform closed-set vendor verification, open- set vendor identification, and low-resource mar- ket adaption tasks. Through VendorLink, we uncover (i) 15 migrants and 71 potential aliases in the Alphabay-Dreams-Silk dataset, (ii) 17 migrants and 3 potential aliases in the Valhalla- Berlusconi dataset, and (iii) 75 migrants and 10 potential aliases in the Traderoute-Agora dataset. Altogether, our approach can help Law Enforcement Agencies (LEA) make more in- formed decisions by verifying and identifying migrating vendors and their potential aliases on existing and Low-Resource (LR) emerging Darknet markets. 1 1 Introduction Conventional search engines index surface-web websites that only constitute 4% of the entire in- ternet (Georgiev, 2021). The remaining comprises 90% Deep Web (not indexed) and 6% Darknet, which uses advanced anonymity enhancing proto- cols (Georgiev, 2021). While the former serves legitimate purposes requiring anonymity, the latter 1Our code implementation is publicly available at https://github.com/maastrichtlawtech/VendorLink.git is also used for illegal activities such as financial fraud (ENISA, 2018), child exploitation (Bruggen and Blokland, 2021), and trading of illicit weapons (Weimann, 2016; Persi Paoli et al., 2017), prohib- ited drugs, and chemicals (Kruithof et al., 2016). Given the Darknet’s scope, size, and anonymity, it is difficult for LEA to uncover connections be- tween illegal marketplaces (Vogt, 2017). While manual detection of such connections is a time- consuming and resource-extensive process, the recent success of online scrapers (Fu et al., 2010; Hayes et al., 2018) and monitoring systems (Schäfer et al., 2019; Godawatte et al., 2019) has enabled researchers and LEA to analyze (Easttom, 2018; Faizan and Khan, 2019; Goodison et al., 2019; Davies, 2020) and automatically identify (Al Nabki et al., 2017; Ghosh et al., 2017; Ubbink et al., 2019; He et al., 2019) Darknet contents. This research proposes a vendor verification and identifi- cation approach to help LEA make better decisions by linking vendors, offloading manual labor, and generating similarity-based analyses. In contrast to the existing Darknet literature (He et al., 2015; Ekambaranathan, 2018; Tai et al., 2019; Kumar et al., 2020; Manolache et al., …

Content truncated to 500 words