research-article

Public Access

You Are Your Photographs: Detecting Multiple Identities of Vendors in the Darknet Marketplaces

Authors:

Gang WangAuthors Info & Claims

ASIACCS '18: Proceedings of the 2018 on Asia Conference on Computer and Communications Security

Pages 431 - 442

https://doi.org/10.1145/3196494.3196529

Published: 29 May 2018 Publication History

Abstract

Darknet markets are online services behind Tor where cybercriminals trade illegal goods and stolen datasets. In recent years, security analysts and law enforcement start to investigate the darknet markets to study the cybercriminal networks and predict future incidents. However, vendors in these markets often create multiple accounts (\em i.e., Sybils), making it challenging to infer the relationships between cybercriminals and identify coordinated crimes. In this paper, we present a novel approach to link the multiple accounts of the same darknet vendors through photo analytics. The core idea is that darknet vendors often have to take their own product photos to prove the possession of the illegal goods, which can reveal their distinct photography styles. To fingerprint vendors, we construct a series deep neural networks to model the photography styles. We apply transfer learning to the model training, which allows us to accurately fingerprint vendors with a limited number of photos. We evaluate the system using real-world datasets from 3 large darknet markets (7,641 vendors and 197,682 product photos). A ground-truth evaluation shows that the system achieves an accuracy of 97.5%, outperforming existing stylometry-based methods in both accuracy and coverage. In addition, our system identifies previously unknown Sybil accounts within the same markets (23) and across different markets (715 pairs). Further case studies reveal new insights into the coordinated Sybil activities such as price manipulation, buyer scam, and product stocking and reselling.

References

[1]

Sadia Afroz, Aylin Caliskan-Islam, Ariel Stolerman, Rachel Greenstadt, and Damon McCoy . 2014. Doppelganger Finder: Taking Stylometry to the Underground Proc. of IEEE SP'14.

Digital Library

[2]

Sadia Afroz, Vaibhav Garg, Damon McCoy, and Rachel Greenstadt . 2013. Honor among thieves: A common's analysis of cybercrime economies Proc. of eCrime'13.

[3]

Arjun Nitin Bhagoji, Daniel Cullina, and Prateek Mittal . 2017. Dimensionality reduction as a defense against evasion attacks on machine learning classifiers. arXiv preprint arXiv:1704.02654 (2017).

[4]

Danny Bradbury . 2014. Silk Road 2 Loses Over $2.6 Million in Bitcoins in Alleged Hack. (2014). deftempurl%https://www.coindesk.com/silk-road-2-loses-bitcoins-hack tempurl

[5]

Gwern Branwen, Nicolas Christin, David Décary-Hétu, Rasmus Munksgaard Andersen, StExo, El Presidente, Anonymous, Daryl Lau, Sohhlz, Delyan Kratunov, Vince Cakic, Van Buskirk, Whom, Michael McKenna, and Sigi Goode . 2015. Dark Net Market archives, 2011--2015. (2015). https://www.gwern.net/DNM-archives.

[6]

Aylin Caliskan-Islam, Richard Harang, Andrew Liu, Arvind Narayanan, Clare Voss, Fabian Yamaguchi, and Rachel Greenstadt . 2015. De-anonymizing Programmers via Code Stylometry. In Proc. of USENIX Security'15.

Digital Library

[7]

Alfredo Canziani, Adam Paszke, and Eugenio Culurciello . 2016. An analysis of deep neural network models for practical applications. arXiv preprint arXiv:1605.07678 (2016).

[8]

Nicholas Carlini and David Wagner . 2017. Towards evaluating the robustness of neural networks Proc. of IEEE SP'17.

[9]

M. Chen, J. Fridrich, M. Goljan, and J. Lukas . 2008. Determining Image Origin and Integrity Using Sensor Noise. IEEE Transactions on Information Forensics and Security Vol. 3, 1 (2008), 74--90.

Digital Library

[10]

Kai San Choi, Edmund Y. Lam, and Kenneth K. Y. Wong . 2006. Source camera identification using footprints from lens aberration Proc. of SPIE Digital Photography II.

[11]

Nicolas Christin . 2013. Traveling the Silk Road: A Measurement Analysis of a Large Anonymous Online Marketplace Proc. of WWW'13.

Digital Library

[12]

Roger Dingledine, Nick Mathewson, and Paul Syverson . 2004. Tor: The Second-generation Onion Router. In Proc. of USENIX Security'04.

Digital Library

[13]

Greg Durrett, Jonathan K. Kummerfeld, Taylor Berg-Kirkpatrick, Rebecca S. Portnoff, Sadia Afroz, Damon McCoy, Kirill Levchenko, and Vern Paxson . 2017. Identifying Products in Online Cybercrime Marketplaces: A Dataset for Fine-grained Domain Adaptation. In Proc. of EMNLP'17.

[14]

S. Farooqi, G. Jourjon, M. Ikram, M. A. Kaafar, E. De Cristofaro, Z. Shafiq, A. Friedman, and F. Zaffar . 2017. Characterizing key stakeholders in an online black-hat marketplace Proc. of eCrime'17.

[15]

Vaibhav Garg, Sadia Afroz, Rebekah Overdorf, and Rachel Greenstadt . 2015. Computer-supported cooperative crime. In Proc. of FC'15.

[16]

Stamatios Georgoulis, Konstantinos Rematas, Tobias Ritschel, Mario Fritz, Tinne Tuytelaars, and Luc Van Gool . 2017. What Is Around The Camera?. In Proc. of ICCV'17.

[17]

Oana Goga, Howard Lei, Sree Hari Krishnan Parthasarathi, Gerald Friedland, Robin Sommer, and Renata Teixeira . 2013. Exploiting Innocuous Activity for Correlating Users Across Sites Proc. of WWW'13.

Digital Library

[18]

Ian Goodfellow, Jonathon Shlens, and Christian Szegedy . 2015. Explaining and harnessing adversarial examples. In Proc. of ICLR'15.

[19]

Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten . 2017. Countering Adversarial Images using Input Transformations. arXiv preprint arXiv:1711.00117 (2017).

[20]

Andreas Haslebacher, Jeremiah Onaolapo, and Gianluca Stringhini . 2016. All Your Cards Are Belong To Us: Understanding Online Carding Forums Proc. of eCrime'17.

[21]

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun . 2016. Deep residual learning for image recognition. In Proc. of CVPR'16.

[22]

Thanh Nghia Ho and Wee Keong Ng . 2016. Application of Stylometry to DarkWeb Forum User Identification. In Proc. of ICICS'16.

[23]

Thomas J Holt and Eric Lampke . 2010. Exploring stolen data markets online: products and market forces. Criminal Justice Studies Vol. 23, 1 (2010), 33--50.

[24]

Yedid Hoshen and Shmuel Peleg . 2016. An Egocentric Look at Video Photographer Identity. In Proc. of CVPR'16.

[25]

Gao Huang, Zhuang Liu, Kilian Q Weinberger, and Laurens van der Maaten . 2016. Densely connected convolutional networks. arXiv preprint arXiv:1608.06993 (2016).

[26]

C. R. Johnson, E. Hendriks, I. J. Berezhnoy, E. Brevdo, S. M. Hughes, I. Daubechies, J. Li, E. Postma, and J. Z. Wang . 2008. Image processing for artist identification. IEEE Signal Processing Magazine Vol. 25, 4 (2008), 37--48.

[27]

Rasoul Kaljahi, Jennifer Foster, Johann Roturier, Corentin Ribeyre, Teresa Lynn, and Joseph Le Roux . 2015. Foreebank: Syntactic analysis of customer support forums Proc. of EMNLP'15.

[28]

Su Nam Kim, Li Wang, and Timothy Baldwin . 2010. Tagging and linking web forum posts. In Proc. of CoNLL'10.

Digital Library

[29]

Frederik Kratzert . 2016. Finetune AlexNet with Tensorflow. (2016). deftempurl%https://github.com/kratzert/finetune_alexnet_with_tensorflow tempurl

[30]

Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton . 2012. Imagenet classification with deep convolutional neural networks Proc. of NIPS'12.

Digital Library

[31]

Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio . 2017. Adversarial examples in the physical world. In Proc. of ICLR workshop.

[32]

Yann LeCun, Yoshua Bengio, and Geoffrey Hinton . 2015. Deep learning. Nature Vol. 521, 7553 (2015), 436--444.

[33]

Marco Lui and Timothy Baldwin . 2010. Classifying user forum participants: Separating the gurus from the hacks, and other tales of the internet. In Australasian Language Technology Association Workshop 2010.

[34]

J. Lukas, J. Fridrich, and M. Goljan . 2006. Digital Camera Identification from Sensor Pattern Noise. IEEE Transactions on Information Forensics and Security Vol. 1, 2 (2006), 205--214.

Digital Library

[35]

Damon McCoy, Andreas Pitsillidis, Jordan Grant, Nicholas Weaver, Christian Kreibich, Brian Krebs, Geoffrey Voelker, Stefan Savage, and Kirill Levchenko . 2012. PharmaLeaks: Understanding the Business of Online Pharmaceutical Affiliate Programs Proc. of UNENIX Security'12.

Digital Library

[36]

Dongyu Meng and Hao Chen . 2017. MagNet: a Two-Pronged Defense against Adversarial Examples Proc. of CCS'17.

Digital Library

[37]

Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard . 2016. DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks Proc. of CVPR'16.

[38]

Marti Motoyama, Damon McCoy, Kirill Levchenko, Stefan Savage, and Geoffrey M Voelker . 2011. An analysis of underground forums. In Proc. of IMC'11.

Digital Library

[39]

NLTK . 2017. Natural Language Toolkit. (2017). http://www.nltk.org/

[40]

Maxime Oquab, Leon Bottou, Ivan Laptev, and Josef Sivic . 2014. Learning and transferring mid-level image representations using convolutional neural networks. In Proc. of CVPR'14.

Digital Library

[41]

Nicolas Papernot, Patrick D. McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami . 2016. The Limitations of Deep Learning in Adversarial Settings Proc. of Euro SP'16.

[42]

Rebecca S Portnoff, Sadia Afroz, Greg Durrett, Jonathan K Kummerfeld, Taylor Berg-Kirkpatrick, Damon McCoy, Kirill Levchenko, and Vern Paxson . 2017. Tools for Automated Analysis of Cybercriminal Markets Proc. of WWW'17.

Digital Library

[43]

Tong Qiao, Florent Retraint, Rémi Cogranne, and Thanh Hai Thai . 2017. Individual camera device identification from JPEG images. Signal Processing: Image Communication Vol. 52 (2017), 74 -- 86.

Digital Library

[44]

Andras Rozsa, Ethan M. Rudd, and Terrance E. Boult . 2016. Adversarial Diversity and Hard Positive Generation Proc. of CVPR Workshop.

[45]

Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei . 2015. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV) Vol. 115, 3 (2015), 211--252.

Digital Library

[46]

Hoo-Chang Shin, Holger R Roth, Mingchen Gao, Le Lu, Ziyue Xu, Isabella Nogues, Jianhua Yao, Daniel Mollura, and Ronald M Summers . 2016. Deep convolutional neural networks for computer-aided detection: CNN architectures, dataset characteristics and transfer learning. IEEE transactions on medical imaging Vol. 35, 5 (2016), 1285--1298.

[47]

Karen Simonyan and Andrew Zisserman . 2014. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014).

[48]

Kyle Soska and Nicolas Christin . 2015. Measuring the Longitudinal Evolution of the Online Anonymous Marketplace Ecosystem Proc. of USENIX Security'15.

Digital Library

[49]

Brett Stone-Gross, Thorsten Holz, Gianluca Stringhini, and Giovanni Vigna . 2011. The Underground Economy of Spam: A Botmaster's Perspective of Coordinating Large-scale Spam Campaigns. In Proc. of LEET'11.

Digital Library

[50]

Jiawei Su, Danilo Vasconcellos Vargas, and Sakurai Kouichi . 2017. One pixel attack for fooling deep neural networks. arXiv preprint arXiv:1710.08864 (2017).

[51]

Srikanth Sundaresan, Damon McCoy, Sadia Afroz, and Vern Paxson . 2016. Profiling underground merchants based on network behavior Proc. of eCrime'16.

[52]

Christian Szegedy, Sergey Ioffe, Vincent Vanhoucke, and Alexander A Alemi . 2017. Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learning Proc. of AAAI'17.

[53]

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus . 2014. Intriguing properties of neural networks. In Proc. of ICLR'14.

[54]

Nima Tajbakhsh, Jae Y Shin, Suryakanth R Gurudu, R Todd Hurst, Christopher B Kendall, Michael B Gotway, and Jianming Liang . 2016. Convolutional neural networks for medical image analysis: Full training or fine tuning? IEEE transactions on medical imaging Vol. 35, 5 (2016), 1299--1312.

[55]

Thanh Hai Thai, Florent Retraint, and Rémi Cogranne . 2016. Camera Model Identification Based on the Generalized Noise Model in Natural Images. Digit. Signal Process. Vol. 48, C (2016), 285--297.

Digital Library

[56]

Christopher Thomas and Adriana Kovashka . 2016. Seeing Behind the Camera: Identifying the Authorship of a Photograph Proc. of CVPR'16.

[57]

Kristina Toutanova, Dan Klein, Christopher D Manning, and Yoram Singer . 2003. Feature-rich part-of-speech tagging with a cyclic dependency network Proc. of NAACL'03.

Digital Library

[58]

Nicky Woolf . 2015. Bitcoin “exit scam”: deep-web market operators disappear with $12m. (2015). deftempurl%https://www.theguardian.com/technology/2015/mar/18/bitcoin-deep-web-evolution-exit-scam-12-million-dollars tempurl

[59]

Weilin Xu, David Evans, and Yanjun Qi . 2017. Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks. arXiv preprint arXiv:1704.01155 (2017).

[60]

M. Yip, N. Shadbolt, and C. Webber . 2012. Structural analysis of online criminal social networks Proc. of ISI'12.

[61]

Felix Yu . 2016. Fine-tune Convolutional Neural Network in Keras with ImageNet Pretrained Models. (2016). deftempurl%https://github.com/flyyufelix/cnn_finetune tempurl

[62]

Stephan Zheng, Yang Song, Thomas Leung, and Ian J. Goodfellow . 2016. Improving the Robustness of Deep Neural Networks via Stability Training Proc. of CVPR'16.

Cited By

Fan SRanly PGraner LVogel ISteinebach M(2024)Unveiling the Darkness: Analysing Organised Crime on the Wall Street Market Darknet Marketplace using PGP Public KeysProceedings of the 19th International Conference on Availability, Reliability and Security10.1145/3664476.3670464(1-10)Online publication date: 30-Jul-2024
https://dl.acm.org/doi/10.1145/3664476.3670464
Lykousas NKoutsokostas VCasino FPatsakis C(2023)The Cynicism of Modern Cybercrime: Automating the Analysis of Surface Web Marketplaces2023 IEEE International Conference on Service-Oriented System Engineering (SOSE)10.1109/SOSE58276.2023.00027(161-171)Online publication date: Jul-2023
https://doi.org/10.1109/SOSE58276.2023.00027
Ogbanufe OWolfe JBaucum F(2023)Towards a Conceptual Typology of Darknet RisksJournal of Computer Information Systems10.1080/08874417.2023.223432364:4(565-576)Online publication date: 14-Jul-2023
https://doi.org/10.1080/08874417.2023.2234323
Show More Cited By

Index Terms

You Are Your Photographs: Detecting Multiple Identities of Vendors in the Darknet Marketplaces

Recommendations

Your Style Your Identity: Leveraging Writing and Photography Styles for Drug Trafficker Identification in Darknet Markets over Attributed Heterogeneous Information Network
WWW '19: The World Wide Web Conference

Due to its anonymity, there has been a dramatic growth of underground drug markets hosted in the darknet (e.g., Dream Market and Valhalla). To combat drug trafficking (a.k.a. illicit drug trading) in the cyberspace, there is an urgent need for automatic ...
eDarkFind: Unsupervised Multi-view Learning for Sybil Account Detection
WWW '20: Proceedings of The Web Conference 2020

Darknet crypto markets are online marketplaces using crypto currencies (e.g., Bitcoin, Monero) and advanced encryption techniques to offer anonymity to vendors and consumers trading for illegal goods or services. The exact volume of substances ...
101 Quick and Easy Secrets to Create Winning Photographs

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

ASIACCS '18: Proceedings of the 2018 on Asia Conference on Computer and Communications Security

May 2018

866 pages

ISBN:9781450355766

DOI:10.1145/3196494

General Chairs:
Jong Kim
Pohang University of Science and Technology, South Korea
,
Gail-Joon Ahn
Arizona State University, USA &Samsung Electronics, South Korea
,
Seungjoo Kim
Korea University, South Korea
,
Program Chairs:
Yongdae Kim
KAIST, South Korea
,
Javier Lopez
University of Malaga, Spain
,
Taesoo Kim
Georgia Tech, USA

Copyright © 2018 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGSAC: ACM Special Interest Group on Security, Audit, and Control

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 29 May 2018

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

National Science Foundation

Conference

ASIA CCS '18

Sponsor:

SIGSAC

ASIA CCS '18: ACM Asia Conference on Computer and Communications Security

June 4, 2018

Incheon, Republic of Korea

Acceptance Rates

ASIACCS '18 Paper Acceptance Rate 52 of 310 submissions, 17%;

Overall Acceptance Rate 418 of 2,322 submissions, 18%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

20
Total Citations
View Citations
851
Total Downloads

Downloads (Last 12 months)134
Downloads (Last 6 weeks)23

Reflects downloads up to 03 Oct 2024

Other Metrics

View Author Metrics

Citations

Cited By

Fan SRanly PGraner LVogel ISteinebach M(2024)Unveiling the Darkness: Analysing Organised Crime on the Wall Street Market Darknet Marketplace using PGP Public KeysProceedings of the 19th International Conference on Availability, Reliability and Security10.1145/3664476.3670464(1-10)Online publication date: 30-Jul-2024
https://dl.acm.org/doi/10.1145/3664476.3670464
Lykousas NKoutsokostas VCasino FPatsakis C(2023)The Cynicism of Modern Cybercrime: Automating the Analysis of Surface Web Marketplaces2023 IEEE International Conference on Service-Oriented System Engineering (SOSE)10.1109/SOSE58276.2023.00027(161-171)Online publication date: Jul-2023
https://doi.org/10.1109/SOSE58276.2023.00027
Ogbanufe OWolfe JBaucum F(2023)Towards a Conceptual Typology of Darknet RisksJournal of Computer Information Systems10.1080/08874417.2023.223432364:4(565-576)Online publication date: 14-Jul-2023
https://doi.org/10.1080/08874417.2023.2234323
Zou FHu YXu WWu Y(2023)Link Prediction-Based Multi-Identity Recognition of Darknet VendorsInformation and Communications Security10.1007/978-981-99-7356-9_19(317-332)Online publication date: 20-Oct-2023
https://doi.org/10.1007/978-981-99-7356-9_19
Almomani AAlauthman MAlkasassbeh MSamara GLiu R(2023)A Proposed Darknet Traffic Classification System Based on Max Voting AlgorithmsInternational Conference on Cyber Security, Privacy and Networking (ICSPN 2022)10.1007/978-3-031-22018-0_32(349-355)Online publication date: 21-Feb-2023
https://doi.org/10.1007/978-3-031-22018-0_32
Manolache ABrad FBarbalau AIonescu RPopescu MKoyejo SMohamed SAgarwal ABelgrave DCho KOh A(2022)VeriDarkProceedings of the 36th International Conference on Neural Information Processing Systems10.5555/3600270.3601403(15574-15588)Online publication date: 28-Nov-2022
https://dl.acm.org/doi/10.5555/3600270.3601403
Vyas PVyas GChauhan ARawat RTelang SGottumukkala M(2022)Anonymous Trading on the Dark Online MarketplaceUsing Computational Intelligence for the Dark Web and Illicit Behavior Detection10.4018/978-1-6684-6444-1.ch015(272-289)Online publication date: 6-May-2022
https://doi.org/10.4018/978-1-6684-6444-1.ch015
Tazi FShrestha SDe La Cruz JDas S(2022)SoK: An Evaluation of the Secure End User Experience on the Dark Net through Systematic Literature ReviewJournal of Cybersecurity and Privacy10.3390/jcp20200182:2(329-357)Online publication date: 27-May-2022
https://doi.org/10.3390/jcp2020018
Yannikos YHeeger JSteinebach M(2022)Data Acquisition on a Large Darknet MarketplaceProceedings of the 17th International Conference on Availability, Reliability and Security10.1145/3538969.3544472(1-6)Online publication date: 23-Aug-2022
https://dl.acm.org/doi/10.1145/3538969.3544472
Covrig BMikelarena ERosca CGoanta CSpanakis GZarras A(2022)Upside Down: Exploring the Ecosystem of Dark Web Data MarketsICT Systems Security and Privacy Protection10.1007/978-3-031-06975-8_28(489-506)Online publication date: 3-Jun-2022
https://doi.org/10.1007/978-3-031-06975-8_28
Show More Cited By

View Options

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

Media

Figures

Other

Tables

View Table of Contents