We introduce a system for automatically generating warnings of imminent or current cyber-threats. Our system leverages the communication of malicious actors on the darkweb, as well as activity of cyber security experts on social media platforms like Twitter. In a time period between September, 2016 and January, 2017, our method generated 661 alerts of which about 84 were relevant to current or imminent cyber-threats. In the paper, we first illustrate the rationale and workflow of our system, then we measure its performance. Our analysis is enriched by two case studies: the first shows how the method could predict DDoS attacks, and how it would have allowed organizations to prepare for the Mirai attacks that caused widespread disruption in October 2016. Second, we discuss the method's timely identification of various instances of data breaches.
Cybersecurity is a problem of growing relevance that impacts all facets of society. As a result, many researchers have become interested in studying cybercriminals and online hacker communities in order to develop more effective cyber defenses. In particular, analysis of hacker community contents may reveal existing and emerging threats that pose great risk to individuals, businesses, and government. Thus, we are interested in developing an automated methodology for identifying tangible and verifiable evidence of potential threats within hacker forums, IRC channels, and carding shops. To identify threats, we couple machine learning methodology with information retrieval techniques. Our approach allows us to distill potential threats from the entirety of collected hacker contents. We present several examples of identified threats found through our analysis techniques. Results suggest that hacker communities can be analyzed to aid in cyber threat detection, thus providing promising direction for future work. Cyber-criminals around the world are using Internet-based communication channels to establish trade relationships and complete fraudulent transactions. Furthermore, they control and operate publicly accessible information channels that serve as marketplaces for the underground economy. In this work, we present a novel system for automatically monitoring these channels and their participants. Our approach is focused on creating a stealthy system, which allows it to stay largely undetected by both marketplace operators and participants. We implemented a prototype that is capable of monitoring IRC (Internet Relay Chat) and web forum marketplaces, and successfully performed an experimental evaluation over a period of 11 months. In our experimental evaluation we present the findings about the captured underground information channels and their characteristics. As computing and communication technologies become ubiquitous throughout society, researchers and practitioners have become motivated to advance current cybersecurity capabilities. In particular, research on the human element behind cybercrime would offer new knowledge on securing cyberspace against those with malicious intent. Past work documents the existence of many hacker communities with participants sharing various cybercriminal assets and knowledge. However, participants vary in expertise, with some possessing only passing curiosity while others are capable cybercriminals. Here we develop a time-to-event based approach for assessing the relationship between various participation behaviors and participation length among hacker Internet Relay Chat (IRC) community participants. Using both the Kaplan-Meier model and Cox's model, we are able to develop predictions on individuals' participation trajectorybased on a series of message content and social network features. Results indicate that participation volume, discussion of pertinent topics, and social interconnectedness are all important at varying levels for identifying participants within hacker communities that have potential to become adept cybercriminals. A substantive body of research has emerged exploring the social dynamics and subculture of computer hacking. Few, however, have considered the structure of social networks in the hacker community due in part to the lack of visible information about active hackers or malware writers. Our research focuses on the rarely studied subject of underground networks of computer hackers. Thus, this study explores the social networks of a group of Russian hackers using publicly accessible data to understand the nature of social relationships and the ways that they affect information sharing and action. The findings demonstrate that there are a limited number of highly skilled hackers relative to those with some knowledge of computers. Additionally, those hackers with substantive technical skills are centrally located within friendship networks and are the focus of greater attention overall. The impact of these findings for our understanding of computer hacking, and peer networks generally are considered in detail.   Illicit computer intruders, or hackers, are often thought of as pathological individuals rather than as members of a community. However, hackers exist within social groups that provide expertise, support, training, journals and conferences. This article outlines this community to establish the nature of hacking within ‘information societies’. To delineate a ‘sociology of hackers’, an introduction is provided to the nature of computer–mediated communication and the act of computer intrusion, the hack. Following this the hacking community is explored in three sections. First, a profile of the number of hackers and hacks is provided by exploring available demographics. Second, an outline of its culture is provided through a discussion of six different aspects of the hacking community. The six aspects are technology, secrecy, anonymity, membership fluidity, male dominance and motivations. Third, an exploration of the community's construction of a boundary, albeit fluid, between itself and its other, the computer security industry, is provided. This boundary is constructed through metaphors whose central role is to establish the ethical nature of hacking. Finally, a conclusion that rejects any pathologisation of hackers is offered. Underground forums, where participants exchange information on abusive tactics and engage in the sale of illegal goods and services, are a form of online social network (OSN). However, unlike traditional OSNs such as Facebook, in underground forums the pattern of communications does not simply encode pre-existing social relationships, but instead captures the dynamic trust relationships forged between mutually distrustful parties. In this paper, we empirically characterize six different underground forums --- BlackHatWorld, Carders, HackSector, HackE1ite, Freehack, and L33tCrew --- examining the properties of the social networks formed within, the content of the goods and services being exchanged, and lastly, how individuals gain and lose trust in this setting.