Abstract
Cybercrime forums play a central role in the cybercrime ecosystem, serving as hubs for the exchange of illicit goods, services, and knowledge. Previous studies have explored the market and social structures of these forums, but less is known about the behavioral dynamics of users, particularly regarding participants' disclosure of criminal activity. This study provides the first large-scale assessment of crime disclosure patterns in a major cybercrime forum, analysing over 3.5 million posts from nearly 300k users. Using a three-level classification scheme (benign, grey, and crime) and a scalable labelling pipeline powered by large language models (LLMs), we measure the level of crime disclosure present in initial posts, analyse how participants switch between levels, and assess how crime disclosure behavior relates to private communications. Our results show that crime disclosure is relatively normative: one quarter of initial posts include explicit crime-related content, and more than one third of users disclose criminal activity at least once in their initial posts. At the same time, most participants show restraint, with over two-thirds posting only benign or grey content and typically escalating disclosure gradually. Grey initial posts are particularly prominent, indicating that many users avoid overt statements and instead anchor their activity in ambiguous content. The study highlights the value of LLM-based text classification and Markov chain modelling for capturing crime disclosure patterns, offering insights for law enforcement efforts aimed at distinguishing benign, grey, and criminal content in cybercrime forums.
Abstract (translated)
网络犯罪论坛在网络犯罪生态系统中扮演着核心角色，作为非法商品、服务和知识交换的中心。先前的研究探讨了这些论坛的市场和社会结构，但对于用户的行为动态了解较少，特别是关于参与者披露犯罪活动的情况。本研究提供了对一个主要网络犯罪论坛内犯罪信息披露模式的首次大规模评估，分析了近30万用户的逾350万个帖子。通过采用三级分类体系（良性、灰色和犯罪）及由大型语言模型（LLM）驱动的可扩展标签流水线，我们测量了初始帖子中所包含的犯罪披露水平，分析了参与者在不同层级之间的切换，并评估了犯罪信息披露行为与私人通信的关系。 研究结果表明，犯罪信息披露是相对常规的现象：四分之一以上的初始帖子包含了明确的犯罪相关内容，超过三分之一的用户至少在其初始帖子中披露过一次犯罪活动。与此同时，大多数参与者表现出谨慎态度，三分之二以上的人仅发布良性或灰色内容，并通常逐步增加其披露的强度。灰色的初始帖子尤为突出，表明许多用户避免做出直接声明，而是将他们的行为锚定在模棱两可的内容上。 该研究强调了基于LLM的文本分类和马尔科夫链建模对于捕捉犯罪信息披露模式的价值，为旨在区分网络犯罪论坛内良性、灰色及犯罪内容的执法努力提供了见解。
URL
https://arxiv.org/abs/2603.01624
