Underground online forums are platforms that enable trades of illicit services and stolen goods. Carding forums, in particular, are known for being focused on trading financial information. However, little evidence exists about the sellers that are present on carding forums, the precise types of products they advertise, and the prices buyers pay. Existing literature mainly focuses on the organisation and structure of the forums. Furthermore, studies on carding forums are usually based on literature review, expert interviews, or data from forums that have already been shut down. This paper provides first-of-its-kind empirical evidence on active forums where stolen financial data is traded. We monitored 5 out of 25 discovered forums, collected posts from the forums over a three-month period, and analysed them quantitatively and qualitatively. We focused our analyses on products, prices, seller prolificacy, seller specialisation, and seller reputation.
In terms of seller prolificacy, @cite_0 analysed the records of 6 closed forums and concluded that 10 It is common ground among crime scientists that crime is distributed neither randomly nor evenly @cite_17 . That implies a small group accounts for more offenses than its expected share would be. As earlier stated, studies on marketplaces suggest the presence of some highly prolific users. We hypothesise ( 2 ) that on active carding forums, a small number of traders are responsible for a large proportion of traffic.
@cite_0 @cite_17
2153532176 2004621612 2597730742 1971105953 121858502 2116338588 2901662176 1994473607 1484003379 2140200133 2007590415 2620184808 2123407642 2951248203 2232384272 2118110552 1993968931 1996069568 2560267416 1490158239
Over the last decade, the nature of cybercrime has transformed from naive vandalism to profit-driven, leading to the emergence of a global underground economy. A noticeable trend which has surfaced in this economy is the repeated use of forums to operate online stolen data markets. Using interaction data from three prominent carding forums: Shadowcrew, Cardersmarket and Darkmarket, this study sets out to understand why forums are repeatedly chosen to operate online stolen data markets despite numerous successful infiltrations by law enforcement in the past. Drawing on theories from criminology, social psychology, economics and network science, this study has identified four fundamental socio-economic mechanisms offered by carding forums: (1) formal control and coordination; (2) social networking; (3) identity uncertainty mitigation; (4) quality uncertainty mitigation. Together, they give rise to a sophisticated underground market regulatory system that facilitates underground trading over the Internet and thus drives the expansion of the underground economy. As consumers are increasingly using the Internet to manage their finances, there has been a concomitant increase in the risk of theft and fraud by cybercriminals. Hackers who acquire sensitive consumer data utilise information on their own, or sell the information in online forums for a significant profit. Few have considered the organisational composition of the participants engaged in the sale of stolen data, including the presence of managerial oversight, division of labour, coordination of roles and purposive associations between buyers, sellers and forum operators. Thus, this qualitative study will apply Best and Luckenbill's framework of social organisation to a sample of threads from publicly accessible web forums where individuals buy and sell stolen financial information. The implications of this study for criminologists, law enforcement, the intelligence community and information security researchers will be discussed in depth. As crowd-sourced curation of news and information become the norm, it is important to understand not only how individuals consume information through social news Web sites, but also how they contribute to their ranking systems. In this paper, we introduce and make available a new data set containing the activity logs that recorded all activity for 309 Reddit users for one year. Using this newly collected data, we present findings that highlight the browsing and voting behavior of the study’s participants. We find that most users do not read the article that they vote on, and that, in total, 73 of posts were rated (i.e., upvoted or downvoted) without first viewing the content. We also show the evidence of cognitive fatigue in the browsing sessions of users that are most likely to vote. We live in a computerized and networked society where many of our actions leave a digital trace and affect other people’s actions. This has lead to the emergence of a new data-driven research field: mathematical methods of computer science, statistical physics and sociometry provide insights on a wide range of disciplines ranging from social science to human mobility. A recent important discovery is that search engine traffic (i.e., the number of requests submitted by users to search engines on the www) can be used to track and, in some cases, to anticipate the dynamics of social phenomena. Successful examples include unemployment levels, car and home sales, and epidemics spreading. Few recent works applied this approach to stock prices and market sentiment. However, it remains unclear if trends in financial markets can be anticipated by the collective wisdom of on-line users on the web. Here we show that daily trading volumes of stocks traded in NASDAQ-100 are correlated with daily volumes of queries related to the same stocks. In particular, query volumes anticipate in many cases peaks of trading by one day or more. Our analysis is carried out on a unique dataset of queries, submitted to an important web search engine, which enable us to investigate also the user behavior. We show that the query volume dynamics emerges from the collective but seemingly uncoordinated activity of many users. These findings contribute to the debate on the identification of early warnings of financial systemic risk, based on the activity of users of the www. It is undoubtedly cliche to say that we are in the Age of Big Data Analytics or Data Science; every computing and IT publication you find talks about Big Data and companies no longer are interested in software engineers and analysts but instead they are looking for Data Scientists! In spite of the excessive use of the term, the truth of the matter is that data has never been more available and the increase in computation power allows for more sophisticated tools to identify patterns in the data and on the networks that governs these systems (complex networks). Crime is not different, the open data phenomena has spread to thousand of cities in the world, which are making data about crime activity available for any citizen to look at. Furthermore, new criminology studies argue that criminals typically commit crimes in areas in which they are familiar, usually close to home. Using this information we propose a new model based on networks to build links between crimes in close physical proximity. We show that the structure of the criminal activity can be partially represented by this spatial network of sites. In this paper we describe this process and the analysis of the networks we have constructed to find patterns in the underlying structure of criminal activity. We study the distribution of the activity period of users in five of the largest localized versions of the free, on- line encyclopedia Wikipedia. We find it to be consis- tent with a mixture of two truncated log-normal distri- butions. Using this model, the temporal evolution of these systems can be analyzed, showing that the statis- tical description is consistent over time. contributions: 1. We find all datasets to be consistent with the hypothesis that the lifetime of an user account is described by the su- perposition of two truncated log-normal distributions. An interpretation for this phenomenon is that two different regimes govern the participation of individuals to these versions of the Wikipedia project: the occasional users, who fail to find interest in the project after the first few at- tempts to contribute, and the long-term users, whose with- drawal is probably more related to external factors like the loss of personal incentives in contributing and similar causes. 2. Using our model, we characterize how the participation of users over time evolves, as the system ages. We find that the statistical description of the one-timers is stable over time, while the properties of the group of long-term users change as a consequence of the aging of the system. 3. We find evidence that the inter-edit time distribution de- cays with an heavy tail. In view of this finding, we check that our analysis is not affected by the choice of the pa- rameter used for determining when an user is to be con- sidered "inactive"; we find that for the one-timers it has no quantitative effect. For the statistics of the long-lived users we find instead a very good qualitative agreement. To help their users to discover important items at a particular time, major websites like Twitter, Yelp, TripAdvisor or NYTimes provide Top-K recommendations (e.g., 10 Trending Topics, Top 5 Hotels in Paris or 10 Most Viewed News Stories), which rely on crowdsourced popularity signals to select the items. However, different sections of a crowd may have different preferences, and there is a large silent majority who do not explicitly express their opinion. Also, the crowd often consists of actors like bots, spammers, or people running orchestrated campaigns. Recommendation algorithms today largely do not consider such nuances, hence are vulnerable to strategic manipulation by small but hyper-active user groups. To fairly aggregate the preferences of all users while recommending top-K items, we borrow ideas from prior research on social choice theory, and identify a voting mechanism called Single Transferable Vote (STV) as having many of the fairness properties we desire in top-K item (s)elections. We develop an innovative mechanism to attribute preferences of silent majority which also make STV completely operational. We show the generalizability of our approach by implementing it on two different real-world datasets. Through extensive experimentation and comparison with state-of-the-art techniques, we show that our proposed approach provides maximum user satisfaction, and cuts down drastically on items disliked by most but hyper-actively promoted by a few users. We present an analysis of a person-to-person recommendation network, consisting of 4 million people who made 16 million recommendations on half a million products. We observe the propagation of recommendations and the cascade sizes, which we explain by a simple stochastic model. We analyze how user behavior varies within user communities defined by a recommendation network. Product purchases follow a ‘long tail’ where a significant share of purchases belongs to rarely sold items. We establish how the recommendation network grows over time and how effective it is from the viewpoint of the sender and receiver of the recommendations. While on average recommendations are not very effective at inducing purchases and do not spread very far, we present a model that successfully identifies communities, product, and pricing categories for which viral marketing seems to be very effective. Preface to the Fifth Edition Acknowledgments About the Authors Chapter 1: Eight Fallacies about Crime The Dramatic Fallacy The Cops and Courts Fallacy The Not-Me Fallacy The Innocent- Youth Fallacy The Ingenuity Fallacy The Organized Crime Fallacy The Big Gang Fallacy The Agenda Fallacy Chapter 2: The Chemistry for Crime Risky Settings Stages of a Criminal Act First Three Elements of a Criminal Act Eck's Crime Triangle Predatory Crimes Calming the Waters and Looking after Places Hot Products The General Chemistry of Crime Chapter 3: Offenders Make Decisions The Decision to Commit a Crime Offenders Respond to Everyday Cues Odd and Bizarre Crimes Chapter 4: How Violence Erupts Making Students Angry in a Lab In Real Life Fights vs. Predatory Attacks Violent Decisions It Might Not Work Out Well Chapter 5: Bringing Crime to You Four Stages in the History of Everyday Life Life and Crime in the Convergent City Crime and the Divergent Metropolis Population Density, Shifts, and Patterns of Crime The Great Paradox: Central City Problems Versus Self-Report Evidence Chapter 6: Teenage Crime Perspective on Youth Crime Teenage Zigzags Chapter 7: Big Gang Theory What are Gang Crimes? Fundamentals The Puzzle The Reason for a Gang Chapter 8: Crime Multipliers One Crime Requires Another One Crime Disinhibits Another One Crime Advertises Another One Crime Entices Another One Crime Sets Up Another One Crime Escalates Into Another One Crime Starts A Victim Chain One Co-Offender Attacks Another Chapter 9: Moving Stolen Goods The Thief and the Public Inviting People to Steal More It's Easier to Sell Stolen Goods to the Poor New Avenues for Stolen Goods Chapter 10: Situational Crime Prevention Four Natural Experiments Situational Prevention and Crime Analysis Diverse Applications of Situational Crime Prevention Chapter 11: Local Design Against Crime Remarkable Research on Local Supervision Oscar Newman's Four Types of Space Versions of a Village The Offender-Target Convergence Process Seven Studies in Reducing Local Crime Chapter 12: "White-Collar" Crime How Offenders Get to Their Targets Crimes of Specialized Access Organizational Rank The Specialized-Access Crime Grid Chapter 13: Crime and Social Change Technology, Rightly Understood The Clean Water Example A General Approach: Summing Up This Book How to Think about Changing Crime References Index The high degree of variance of crime rates across space (and across time) is one of the oldest puzzles in the social sciences (see Quetelet (1835)). Our empirical work strongly suggests that this variance is not the result of observed or unobserved geographic attributes. This paper presents a model where social interactions create enough covariance across individuals to explain the high cross- city variance of crime rates. This model provides a natural index of social interactions which can compare the degree of social interaction across crimes, across geographic 1units and across time. Our index gives similar results for different data samples and suggests that the amount of social interactions are highest in petty crimes (such as larceny and auto theft), moderate in more serious crimes (assault, burglary and robbery) and almost negligible in murder and rape. The index of social interactions is also applied to non-criminal choices and we find that there is substantial interaction in schooling choice. Online peer production systems have enabled people to coactively create, share, classify, and rate content on an unprecedented scale. This paper describes strong macroscopic regularities in how people contribute to peer production systems, and shows how these regularities arise from simple dynamical rules. First, it is demonstrated that the probability a person stops contributing varies inversely with the number of contributions he has made. This rule leads to a power law distribution for the number of contributions per person in which a small number of very active users make most of the contributions. The rule also implies that the power law exponent is proportional to the effort required to contribute, as justified by the data. Second, the level of activity per topic is shown to follow a lognormal distribution generated by a stochastic reinforcement mechanism. A small number of very popular topics thus accumulate the vast majority of contributions. These trends are demonstrated to hold across hundreds of millions of contributions to four disparate peer production systems of differing scope, interface style, and purpose. How effectively does a decentralized marketplace aggregate information that is dispersed throughout the economy? We study this question in a dynamic setting, in which sellers have private information that is correlated with an unobservable aggregate state. We first characterize equilibria with an arbitrary finite number of informed traders. A common feature is that each seller’s trading behavior provides an informative and conditionally independent signal about the aggregate state. We then ask whether the state is revealed as the number of informed traders goes to infinity. Perhaps surprisingly, the answer is no. We provide generic conditions under which the amount of information revealed is necessarily bounded and does not reveal the aggregate state. When these conditions are violated, we provide conditions under which there is coexistence of aggregating and non-aggregating equilibria. We discuss the implications for policies meant to enhance information dissemination in markets. In general, a partially revealing information policy can increase trading surplus. There is an alarming increase in the number of cybercrime incidents through anonymous e-mails. The problem of e-mail authorship attribution is to identify the most plausible author of an anonymous e-mail from a group of potential suspects. Most previous contributions employed a traditional classification approach, such as decision tree and Support Vector Machine (SVM), to identify the author and studied the effects of different writing style features on the classification accuracy. However, little attention has been given on ensuring the quality of the evidence. In this paper, we introduce an innovative data mining method to capture the write-print of every suspect and model it as combinations of features that occurred frequently in the suspect's e-mails. This notion is called frequent pattern, which has proven to be effective in many data mining applications, but it is the first time to be applied to the problem of authorship attribution. Unlike the traditional approach, the extracted write-print by our method is unique among the suspects and, therefore, provides convincing and credible evidence for presenting it in a court of law. Experiments on real-life e-mails suggest that the proposed method can effectively identify the author and the results are supported by a strong evidence. The fundamental problem of multiple secondary users contending for opportunistic spectrum access over multiple channels in cognitive radio networks has been formulated recently as a decentralized multi-armed bandit (D-MAB) problem. In a D-MAB problem there are @math users and @math arms (channels) that each offer i.i.d. stochastic rewards with unknown means so long as they are accessed without collision. The goal is to design a decentralized online learning policy that incurs minimal regret, defined as the difference between the total expected rewards accumulated by a model-aware genie, and that obtained by all users applying the policy. We make two contributions in this paper. First, we consider the setting where the users have a prioritized ranking, such that it is desired for the @math -th-ranked user to learn to access the arm offering the @math -th highest mean reward. For this problem, we present the first distributed policy that yields regret that is uniformly logarithmic over time without requiring any prior assumption about the mean rewards. Second, we consider the case when a fair access policy is required, i.e., it is desired for all users to experience the same mean reward. For this problem, we present a distributed policy that yields order-optimal regret scaling with respect to the number of users and arms, better than previously proposed policies in the literature. Both of our distributed policies make use of an innovative modification of the well known UCB1 policy for the classic multi-armed bandit problem that allows a single user to learn how to play the arm that yields the @math -th largest mean reward. The wide availability of user-provided content in online social media facilitates the aggregation of people around common interests, worldviews, and narratives. However, the World Wide Web (WWW) also allows for the rapid dissemination of unsubstantiated rumors and conspiracy theories that often elicit rapid, large, but naive social responses such as the recent case of Jade Helm 15––where a simple military exercise turned out to be perceived as the beginning of a new civil war in the United States. In this work, we address the determinants governing misinformation spreading through a thorough quantitative analysis. In particular, we focus on how Facebook users consume information related to two distinct narratives: scientific and conspiracy news. We find that, although consumers of scientific and conspiracy stories present similar consumption patterns with respect to content, cascade dynamics differ. Selective exposure to content is the primary driver of content diffusion and generates the formation of homogeneous clusters, i.e., “echo chambers.” Indeed, homogeneity appears to be the primary driver for the diffusion of contents and each echo chamber has its own cascade dynamics. Finally, we introduce a data-driven percolation model mimicking rumor spreading and we show that homogeneity and polarization are the main determinants for predicting cascades’ size. The identification of popular and important topics discussed in social networks is crucial for a better understanding of societ al concerns. It is also useful for users to stay on top of trends without having to sift through vast amounts of shared information. Trend detection methods introduced so far have not used the network topology and has thus not been able to distinguish viral topics from topics that are diffused mostly through the news media. To address this gap, we propose two novel structural trend definitions we call coordinated and uncoordinated trends that use friendship information to identify topics that are discussed among clustered and distributed users respectively. Our analyses and experiments show that structural trends are significantly different from traditional trends and provide new insights into the way people share information online. We also propose a sampling technique for structural trend detection and prove that the solution yields in a gain in efficiency and is within an acceptable error bound. Experiments performed on a Twitter data set of 41.7 million nodes and 417 million posts show that even with a sampling rate of 0.005, the average precision is 0.93 for coordinated trends and 1 for uncoordinated trends. We analyze a large query log of 2.3 million anonymous registered users from a web-scale U.S. search engine in order to jointly analyze their on-line behavior in terms of who they might be (demographics), what they search for (query topics), and how they search (session analysis). We examine basic demographics from registration information provided by the users, augmented with U.S. census data, analyze basic session statistics, classify queries into types (navigational, informational, transactional) based on click entropy, classify queries into topic categories, and cluster users based on the queries they issued. We then examine the resulting clusters in terms of demographics and search behavior. Our analysis of the data suggests that there are important differences in search behavior across different demographic groups in terms of the topics they search for, and how they search (e.g., white conservatives are those likely to have voted republican, mostly white males, who search for business, home, and gardening related topics; Baby Boomers tend to be primarily interested in Finance and a large fraction of their sessions consist of simple navigational queries related to online banking, etc.). Finally, we examine regional search differences, which seem to correlate with differences in local industries (e.g., gambling related queries are highest in Las Vegas and lowest in Salt Lake City; searches related to actors are about three times higher in L.A. than in any other region). We formulate and study a decentralized multi-armed bandit (MAB) problem, where M distributed players compete for N independent arms with unknown reward statistics. At each time, each player chooses one arm to play without exchanging information with other players. Players choosing the same arm collide, and, depending on the collision model, either no one receives reward or the colliding players share the reward in an arbitrary way. We show that the minimum system regret of the decentralized MAB grows with time at the same logarithmic order as in the centralized counterpart where players act collectively as a single entity by exchanging observations and making decisions jointly. A general framework of constructing fair and order-optimal decentralized policies is established based on a Time Division Fair Sharing (TDFS) of the M best arms. A lower bound on the system regret growth rate is established for a general class of decentralized polices, to which all TDFS policies belong. We further develop several fair and order-optimal decentralized polices within the TDFS framework and study their performance in different applications including cognitive radio networks, multi-channel communications in unknown fading environment, target collecting in multi-agent systems, and web search and advertising. A wide range of behavior may be seen as destructive to online communities. Yet behavior that is ‘bad’ in one community may be celebrated in another. The work of community maintenance is therefore strongly contextual, involving complex choices due to differing norms, community cross-membership, and the need to invoke fairness. The experienced, “lived in” work of moderators; how they enact norms and make choices about social maintenance, remains poorly understood. Our study addresses this gap, using a negotiated order lens. We employed netnographic techniques, analyzing online interviews with moderators of sub-communities in Reddit, and records of critical incidents. We find that moderators are intuitive prosecutors who draw on a variety of logics to accomplish their work. Controlling bad behavior, articulating and enforcing norms is, therefore, a collective accomplishment through which moderators make choices, create a jurisprudence record, and reconcile nested community norms in the maintenance of social order. This paper examines social structures underlying economic activity in Second Life (SL), a massively multiplayer virtual world that allows users to create and trade virtual objects and commodities. We find that users conduct many of their transactions both within their social networks and within groups. Using frequency of chat as a proxy of tie strength, we observe that free items are more likely to be exchanged as the strength of the tie increases. Social ties particularly play a significant role in paid transactions for sellers with a moderately sized customer base. We further find that sellers enjoying repeat business are likely to be selling to niche markets, because their customers tend to be contained in a smaller number of groups. But while social structure and interaction can help explain a seller's revenues and repeat business, they provide little information in the forecasting a seller's future performance. Our quantitative analysis is complemented by a novel method of visualizing the transaction activity of a seller, including revenue, customer base growth, and repeat business.