The Language of Legal and Illegal Activity on the Darknet

Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 4271–4279 Florence, Italy, July 28 - August 2, 2019. c⃝2019 Association for Computational Linguistics 4271 The Language of Legal and Illegal Activity on the Darknet Leshem Choshen∗ Dan Eldad∗ Daniel Hershcovich∗ School of Computer Science and Engineering The Hebrew University of Jerusalem {leshem.choshen,dan.eldad1,daniel.hershcovich, elior.sulem,omri.abend}@mail.huji.ac.il Elior Sulem∗ Omri Abend Abstract The non-indexed parts of the Internet (the Darknet) have become a haven for both le- gal and illegal anonymous activity. Given the magnitude of these networks, scalably moni- toring their activity necessarily relies on auto- mated tools, and notably on NLP tools. How- ever, little is known about what characteristics texts communicated through the Darknet have, and how well off-the-shelf NLP tools do on this domain. This paper tackles this gap and performs an in-depth investigation of the char- acteristics of legal and illegal text in the Dark- net, comparing it to a clear net website with similar content as a control condition. Tak- ing drug-related websites as a test case, we find that texts for selling legal and illegal drugs have several linguistic characteristics that dis- tinguish them from one another, as well as from the control condition, among them the distribution of POS tags, and the coverage of their named entities in Wikipedia.1 1 Introduction The term “Darknet” refers to the subset of Inter- net sites and pages that are not indexed by search engines. The Darknet is often associated with the “.onion” top-level domain, whose websites are re- ferred to as “Onion sites”, and are reachable via the Tor network anonymously. Under the cloak of anonymity, the Darknet har- bors much illegal activity (Moore and Rid, 2016). Applying NLP tools to text from the Darknet is thus important for effective law enforcement and intelligence. However, little is known about the characteristics of the language used in the Dark- net, and specifically on what distinguishes text on websites that conduct legal and illegal activity. In ∗ Equal contribution 1Our code can be found in https://github.com/ huji-nlp/cyber. Our data is available upon request. fact, the only work we are aware of that classi- fied Darknet texts into legal and illegal activity is Avarikioti et al. (2018), but they too did not inves- tigate in what ways these two classes differ. This paper addresses this gap, and studies the distinguishing features between legal and illegal texts in Onion sites, taking sites that advertise drugs as a test case. We compare our results to a control condition of texts from eBay2 pages that advertise products corresponding to drug key- words. We find a number of distinguishing features. First, we confirm the results of Avarikioti et al. (2018), that text from legal and illegal pages (henceforth, legal and illegal texts) can be distin- guished based on the identity of the content words (bag-of-words) in about 90% accuracy over a bal- anced sample. Second, we find that the distri- bution of POS tags in the documents is a strong cue for …

Content truncated to 500 words