V endor L ink: An NLP approach for Identifying & Linking Vendor Migrants & Potential Aliases on D arknet Markets (2023)

Abstract: The anonymity on the Darknet allows vendors to stay undetected by using multiple vendor aliases or frequently migrating between markets. Consequently, illegal markets and their connections are challenging to uncover on the Darknet. To identify relationships between illegal markets and their vendors, we propose VendorLink, an NLP-based approach that examines writing patterns to verify, identify, and link unique vendor accounts across text advertisements (ads) on seven public Darknet markets. In contrast to existing literature, VendorLink utilizes the strength of supervised pre-training to perform closed-set vendor verification, open-set vendor identification, and low-resource market adaption tasks. Through VendorLink, we uncover (i) 15 migrants and 71 potential aliases in the Alphabay-Dreams-Silk dataset, (ii) 17 migrants and 3 potential aliases in the Valhalla-Berlusconi dataset, and (iii) 75 migrants and 10 potential aliases in the Traderoute-Agora dataset. Altogether, our approach can help Law Enforcement Agencies (LEA) make more informed decisions by verifying and identifying migrating vendors and their potential aliases on existing and Low-Resource (LR) emerging Darknet markets.

## introduction conventional search engines index surface-web websites that only constitute 4% of the entire internet @xcite . the remaining comprises 90% deep web (not indexed) and 6% darknet, which uses advanced anonymity enhancing protocols @xcite . while the former serves legitimate purposes requiring anonymity, the latter 1 our code implementation is publicly available at https://github.com/maastrichtlawtech/vendorlink.git is also used for illegal activities such as financial fraud (enisa, 2018), child exploitation @xcite , and trading of illicit weapons @xcite , prohibited drugs, and chemicals @xcite . given the darknet's scope, size, and anonymity, it is difficult for lea to uncover connections between illegal marketplaces @xcite . while manual detection of such connections is a timeconsuming and resource-extensive process, the recent success of online scrapers @xcite and monitoring systems @xcite has enabled researchers and lea to analyze @xcite @xcite and automatically identify @xcite @xcite darknet contents. this research proposes a vendor verification and identification approach to help lea make better decisions by linking vendors, offloading manual labor, and generating similarity-based analyses. in contrast to the existing darknet literature @xcite @xcite @xcite , vendorlink, as illustrated in figure 1 , emphasizes the following contributions to the problem of verifying and identifying vendors on darknet markets: ## related research vendor verification -a supervised authorship attribution (aa) task: researchers previously have utilized various nlp @xcite @xcite and computer vision @xcite techniques to identify and link vendors across darknet markets. for example, in their research, @xcite proposed ustyle-uid to leverage writing and photography styles to identify vendors in drug trafficking markets. similarly, @xcite proposed exploiting the multi-view learning paradigm and domain-specific knowledge to improve the cross-domain performance with both stylometric and location representation. the darknet ads consist of a product title and description, vendor name, price of the product, and occasionally some meta-data and images. while most of these details were enclosed in the ad's description, manual extraction of these features requires considerable labeling efforts. therefore, we emphasize our research towards an end-to-end approach that only expects the advertisement's title and description to analyze the writing patterns for vendor verification and identification. furthermore, since we perform multi-class classification over the text sequences of darknet ads, we consider our approach similar to the aa task in nlp. with the advances in nlp, there has been considerable research into the field of aa that has demonstrated the success of tfidf-based clustering and classification techniques @xcite , cnns @xcite , rnns @xcite @xcite , and transformers architectures @xcite @xcite . moreover, researchers have also observed a significant difference in language structure between darknet and surface net websites @xcite . therefore, exploring the application of authorship tasks on the darknet language is crucial. ## datasets many researchers have conducted similar experiments on scraped data from active darknet markets. however, since law enforcement has seized and shut down these markets now, we could not reproduce the results nor get access to their data. therefore, for reproducibility and future research pur- task dataset ads. vendors baseline / supervised pre-training alphabay 100,429 1,457 dreams 93,586 1,422 silk road-1 78,681 1,392 alphabay-272,696 4,271 dreams-silk low-resource supervised market adaption valhalla 2,175 110 berlusconi 1,437 84 valhalla-3,612 194 berlusconi high-resource supervised market adaption traderoute 19,952 612 agora 109,644 3,187 traderoute-agora 129,586 3,799 ## experiments before running our experiments, we conduct a sanity check to evaluate the need for ml algorithms by examining the similarity in darknet ads using textdistance-based traditional stylometric approaches (orsinium, 2022) (refer appendix a.1.1). our analyses show that these traditional methods fail to identify vendors with dissimilar ads, indicating the need for sophisticated feature-extraction techniques. furthermore, these approaches help us discard identical ads from further analysis. ## error analysis vendor pred text a text b house tp ** 1 lb of ** 1 oz of ofdank sour [drug1] greenhouse [drug1] (greenhouse) ** greenhouse grown ** house tp ** 1 oz of ** 1 lb of ofdank2.0 [drug2] greehouse [drug2] greehouse grown ** grown ** appleinc fp 10 x c50 euro 5 x $100 dollar counterfeit counterfeit notes (very good strip high quality quality) bills canadian fp [usa to usa] [drug3] [usa to usa] 30 pills pharmacy 80mg just 19.99 [drug3] 100mg 19.99 bucks per pill only usd ultram to better understand the strengths and weaknesses of our trained models, we perform qualitative analysis on the predictions of the bert-cased classifier (trained on the alphabay-dreams-silk road dataset) in the first two examples also show how similar the advertisements are between the vendors "houseofdank" and "houseofdank2.0". this is also indicated by the high similarity in the advertisements of the two vendors (refer 4). finally, the next two examples in the table below indicate the cases of false positives. as can be seen, here, the network is confusing between vocabulary such as "coun-terfeit," "quality," "supernotes," source and destination locations, [drug3], and the price of the product. furthermore, we inspect cases where our trained bert-cased classifier fails, but the transfer-gru classifier succeeds after knowledge transfer. vendor alphabay-dreams-valhalla-silk road berlusconi cannacorner [drug1] 3.5g 7g [drug1] -|mercedes| -|lambo| medicalznl 5 grams 2.5 grams -colombian [drugx] colombian [drugx] 93% + free shipping 90+% pure uncut color credit cards can be lasted update credit cards without security code in this file. we discuss details about additional experiments and the training setup in appendix sections a.1 and a.2, respectively. in addition, the pseudo-code for the cka algorithm is provided in appendix a.3. in the future, we plan to work on the assumptions in section 9 by investigating content-control contrastive learning approaches @xcite to perform vendor verification and identification on existing and emerging darknet datasets. ## conclusion this research presents an nlp-based vendor verification and identification approach, vendorlink, for law enforcement to verify, identify, and link vendor migrants and potential aliases on the existing and emerging darknet markets. in this work, we first perform supervised pre-training to adapt darknet market knowledge and establish a bert-cased classifier to verify existing vendor migrants between markets in a closed-set environment. then, we extract the style representations from the trained bert-cased classifier to compute the text similarity in vendor ads in an open-set environment and link vendors to their potential aliases. finally, we adapt new market knowledge by employing knowledge transfer from the trained bert-cased classifier to a low-compute-resource bigru classifier and perform closed-set vendor verification on the emerging lr markets. through our experiments, we uncover (i) 15 migrants and 71 potential aliases in the alphabay-dreams-silk dataset, (ii) 17 migrants and 3 potential aliases in the valhalla-berlusconi dataset, and (iii) 75 migrants and 10 potential aliases in the traderoute-agora dataset with a cosine similarity of 0.8 and above, between the ads of vendors and their potential aliases.