Visualizing Cyber-Threats in Underground Forums

Abstract

In this paper, we develop a language-agnostic methodology to extract features of interest to an analyst from forum posts and visualize them in a way which facilitates identification and stratification of areas of interest in the forums, as well as further manual analysis of the text. We then apply this methodology to a specific Russian underground forum. The visualization acts as a ‘thumbnail’ for individual posts, conveying semantic metadata of post contents. By viewing the thumbnail, an analyst is provided with an immediate ‘sense’ of post length and key features present within a post, as well as their frequency and spatial arrangement. Using the generated visualizations of posts from the underground forum we speed up analyst identification of post subject matter by up to 72%.As a key novelty, we propose that the image output of our method has fractal properties that can be exploited when sorting threats and extracting highly technical posts. Thus, we use a method based on the Minkowski-Bouligand fractal dimension to prioritize analysis of posts which represent more sophisticated threats.