Identifying Products in Online Cybercrime Marketplaces: A Dataset for Fine-grained Domain Adaptation

TL;DR

This paper introduces a dataset and analysis for identifying products in online cybercrime forums, highlighting cross-domain challenges and the limited effectiveness of existing domain adaptation techniques.

Contribution

It provides a new annotated dataset from four cybercrime forums and analyzes the challenges of domain adaptation in product identification tasks.

Findings

Supervised models perform poorly across different forums.

Standard semi-supervised and domain adaptation techniques have limited success.

The dataset enables future research on cross-domain cybercrime NLP tasks.

Abstract

One weakness of machine-learned NLP models is that they typically perform poorly on out-of-domain data. In this work, we study the task of identifying products being bought and sold in online cybercrime forums, which exhibits particularly challenging cross-domain effects. We formulate a task that represents a hybrid of slot-filling information extraction and named entity recognition and annotate data from four different forums. Each of these forums constitutes its own "fine-grained domain" in that the forums cover different market sectors with different properties, even though all forums are in the broad domain of cybercrime. We characterize these domain differences in the context of a learning-based system: supervised models see decreased accuracy when applied to new forums, and standard techniques for semi-supervised learning and domain adaptation have limited effectiveness on this data, which suggests the need to improve these techniques. We release a dataset of 1,938 annotated posts from across the four forums.