Application of AI Techniques to Deep Web Social Network Analysis

Online Social Networks (Twitter, Facebook, Telegram, and so on) have taken a huge place in the informational space, and are often used for propaganda, manipulation or even recruitment by authoritarian states or terrorist organisations. As the quantity of information makes difficult the human exploitation, solutions to support the military decision makers can only come from the use of AI techniques to extract intelligence from posted texts, to qualify the users’ behaviours, and to identify the emerging social structure. In this article, we will illustrate how to use such techniques on a very peculiar social network hidden in the Dark Web. Thanks to the use of TOR, its members have an excessive feeling of freedom, enabling unconventional posts including hate speech and other hacker offers. We propose to unfold an analysis of 1000 days of activities of this network using NLP techniques to find the most interesting emerging topics. On selected areas of interest, we explain how these techniques can also support the discovery of key actors of the network. We then proceed with a ML-based profiling of the user behaviors. Finally, we introduce influence and cohesion scores for groups of users, which help their characterization and evaluation. 1.0 INTRODUCTION Web 2.0 and the social media have introduced a new paradigm in the informational space. Its specificities as a broadcast media enable anyone to be a new source of information, entertainment, or propaganda, at will. It gives power to the consumer, signalling defects on products; it gives the opportunity to the citizen to directly chat with his/her representatives; overall, the social web enables the user to be more connected and informed. However, the presence of threats on Twitter and other social platforms is attested: the jihadist group Daesh is said to benefit from the support of 100,000 accounts on Twitter [1]; Russia is suspected by the FBI of interferences in the 2016 US election; in almost every election, worldwide, the intensive use of deception has been widely observed during the last years. Automation enables any party to produce and diffuse content quite effectively, if we consider the appearance of malicious accounts in the classic media a victory. The diversity of threats implies a multiplicity of the tools to tackle all of the aspects of the problem. The quantity of messages exchanged in an Online Social Network can be astounding, with almost 500 million new tweets each day. As is possible the automation of their publishing, it is also possible to automate the reading. Opinion mining and topic detection enable the analyst to grasp the trend on a mass of texts, providing a classification along various keywords and characteristics. The user accounts can be classified according to various taxonomies. In this article we distinguish the profile (who the user claims to be), and the behaviour (how s/he performs actions). Unsupervised machine learning Application of AI Techniques to Deep Web Social Network Analysis W3-1 2 STO-MP-IST-160 helps here to cluster the users along similar types, and enables the analyst to recognise similar situations. The never ending list of “friendship” connections, as well as the list of interactions between user accounts, is fertile to grow graphs. This kind of graphs can be used to easily compute social influence scores [2], and to detect one of the most interesting features of a social network: people naturally gather in groups, where there is more continuous interaction. To detect these groups from graphs, we rely on community detection algorithms [3]; specific measures help the analyst to characterise the impact and the pertinence of such groups with regards to his preoccupations [4]. Galaxy2, on Tor, is a strange place. Created in 2015 to replace a predecessor social network (simply called Galaxy), it has been branded as the most frequented social network on Tor. In this article, we show the added value of a variety of tools to scan this very peculiar social network, analyse the topics of discussion during Galaxy2’s uptime, detect its key actors, and discover and characterise its communities. Finally, using all this information, we perform a case study, showing the interest of dedicated tools for social network analysis. This paper is organised as follows: Section 2 presents the website and the context of TOR, Section 3 presents the tools used, Section 4 shows the case study; Section 5 proposes a discussion about our results and concludes this article. 2.0 PRESENTATION OF GALAXY2 2.1 The TOR Network Partly developed through DARPA funding in the 90s, Tor, The Onion Router, has been launched in 2002. Aiming to bring anonymity to the data flow, it relies on an encryption and routing protocol, named onion, to hide the content of the packets to the transiting servers. Tor is used either to anonymously access the clear web, as well as to access the so-called Dark Net: some websites are only accessible through the onion protocol, protecting the host. Well-known examples include a Wikileaks portal, and a disrupted illegal marketplace, the silk road. As anyone can use the Tor network and enjoy the increased privacy, it helps to breach censorship and can be used by journalists, political activists or anyone else. Unfortunately, Tor is also used to host illegal content, such as hacker forums, drug marketplaces, dark forums, porn and pedo-pornography (https://www.fbi.gov/news/stories/playpen-creator-sentenced-to-30-years). However, due to the perceived complexity of use and the strong incentive to link one’s Internet profile with his real life (shopping, all kinds of services.), the global usage of Tor is not very high. Moreover, some countries deploy firewalls, laws and rules to prohibit this kind of tools. Figure 1 shows the global usage of Tor as of 2014, sizing the countries by the total amount of users. Western Europe hosts most of them; Russia and the Middle East are also very present. On this map lies an invisible giant: continental China disapproves Tor. 2.2 Galaxy2: History and Main Features Founded in 2015 after the disruption of a previous Tor hosted social network (“Galaxy”), Galaxy2 is based on an open source framework named elgg, enabling to build small social websites. According to its anonymous founder, Lameth, “The server broke down and your terrible host here (me, not the current host, mind you! ) hadn’t been keeping regular backups off the server”. The service is shut down since end of October 2017 (https://socialmediaalternatives.org/archive/collections/show/10). Application of AI Techniques to Deep Web Social Network Analysis STO-MP-IST-160 W3-1 3 The main features of Galaxy2 include The Wire, a space for microblogging posts; blogs, polls and pages; image and file sharing. Because of the anonymity introduced by the Tor network, the users are less keen to use their real names, and do not expose personal data. Thus, only the private direct messages are kept private, and it was possible to consult all the posts, friendship connections, images and comments performed by the users over the almost three years of uptime. Figure 1: Geographies of Tor, Stefano De Sabbata. The collection of our corpus covers a time range from Galaxy2 creation, on 9th of January, 2015 to the 22nd of September, 2017. It includes all traces of activity logged and then publicly available, but does not consists of personal profiles nor photos, excluded of the collect. 3.0 TOOLS FOR SOCIAL MEDIA ANALYSIS 3.1 Focused on Text Processing The first axis of analysis deals with text processing. The tremendous amount of new messages emitted through the Online Social Networks pushed the development of machine text understanding and summary. Moreover, as users often express their feelings and opinions about products, facts and events, one of the most necessary tasks is opinion mining, which can briefly be explained as the automatic computation of a couple (topic, sentiment) matching a message [5]. The sentiment, or polarity, enables the evaluation of the support or reject of an entity by the author of a message. It can be either computed specifically with a topic, using a learning corpus, or generically using linguistic resources. Such a resource, SentiWordNet [6], associates polarities with sets of synonyms. An analyser, Vader [7], has been made available as an open source module, and compiles various resources and a classifier to compute sentiment scores, at document level. Application of AI Techniques to Deep Web Social Network Analysis W3-1 4 STO-MP-IST-160 Topic detection can be performed either through a supervised or an unsupervised method. An analyst can describe a topic using a few keywords, or rely on text clustering to let an algorithm cluster similar texts together, based on the semantics. Instead of matching pre-established categories, this approach adapts well to new corpora, enabling the analyst to grasp the topic distribution. Often cited as a reference for text clustering, the Latent Semantic Analysis [8] can briefly be resumed as a dimensionality reduction applied on a matrix where each line consists of the tf*idf representation of a text of the training corpus. A similar method, LDA (Latent Dirichlet Allocation) [9] is said adapted to short text topic classification. It can be associated with a module of visualisation of the detected topics, to better depict their distribution [10]. 3.2 User Profiling One of the main tasks of social network analysis, or social listening, aims to spot the key actors, i.e. the most important users of the network. The focus is commonly directed either towards the influence [2, 11, 12], defined as the ability of a user to trigger actions from other users, or towards community detection [13, 14]. Influence is commonly defined as the ability to engage, i.e. to make the other users do something (typically, sending a message or clicking on a URL). A complete method has been exposed to query Twitter for follow