SYSML: StYlometry with Structure and Multitask Learning: Implications for Darknet Forum Migrant Analysis

TL;DR

This paper introduces a novel stylometry and multitask learning approach using graph embeddings to improve authorship attribution in darknet forums, effectively linking users across encrypted and migrating platforms.

Contribution

It presents a new multitask learning method with graph embeddings for authorship attribution, outperforming existing techniques on darknet forum data.

Findings

Up to 2.5X improvement in Mean Retrieval Rank

2X improvement in Recall@10

Effective across four darknet forums

Abstract

Darknet market forums are frequently used to exchange illegal goods and services between parties who use encryption to conceal their identities. The Tor network is used to host these markets, which guarantees additional anonymization from IP and location tracking, making it challenging to link across malicious users using multiple accounts (sybils). Additionally, users migrate to new forums when one is closed, making it difficult to link users across multiple forums. We develop a novel stylometry-based multitask learning approach for natural language and interaction modeling using graph embeddings to construct low-dimensional representations of short episodes of user activity for authorship attribution. We provide a comprehensive evaluation of our methods across four different darknet forums demonstrating its efficacy over the state-of-the-art, with a lift of up to 2.5X on Mean Retrieval Rank and 2X on Recall@10.