Differences in structure and dynamics of networks retrieved from dark and public web forums

TL;DR

This study compares the structural and dynamic differences between networks from dark web and public web forums, revealing distinct behavioral patterns that can aid in identifying dark web activities on accessible platforms.

Contribution

The paper applies network theory to analyze forum data, uncovering characteristic differences in activity and thread dynamics between dark web and public web forums.

Findings

Distinct degree distributions in dark vs. public forums

Different activity patterns and thread lifetimes

Potential indicators for dark web activity detection

Abstract

Humans make decisions based on the information they obtain from several major sources, among which the comments of others in Internet forums play an increasing role. Such forums cover a wide spectrum of topics and represent an essential tool in choosing the best products, manipulating views or optimizing our decisions regarding a number of aspects of our everyday life. However, many forums have extremely controversial topics and contents including those which radicalize the readers or spread information about dangerous products and ideas (e.g., drugs, weapons or aggressive ideologies). These just mentioned activities are taking place mainly on the so-called "dark web" allowing the hiding of the identity of members using dark forums. We use network theoretical approaches to analyze the data we obtained by studying the connectivity features of the members and the threads within a wide selection of forums (including dark and semi-dark) and establish several characteristic behavioral patterns. Our findings reveal both common and rather different features in the two types of behavior. In particular, we show that the various distributions of quantities, like the activity of the commenters, the dynamics of the threads (defined using their lifetime) or the degree distributions corresponding to the three major types of forums we have investigated display characteristic deviations. This knowledge can be useful, for example, in identifying an activity typical for the dark web when it appears on the public web (since the public web can be accessed and used much more easily).