Technical Summary: Topical Shifts in the Dark Web

Problem Statement

The dark web serves as a critical infrastructure for cybercrime, yet existing research largely treats this ecosystem through static snapshots or short-term corpora. Prior studies focus on extracting actionable Cyber Threat Intelligence (CTI) such as indicators of compromise or marketplace listings, often relying on dictionary-based methods or limited machine learning applications. A significant gap exists in understanding how cybercrime-related discussions evolve over time. Current approaches fail to distinguish between stable core activities and transient trends because they lack a longitudinal perspective. Without tracking the emergence, persistence, and disappearance of topics across the broader cybercrime ecosystem, security analysis remains reactive rather than strategic.

Methodology

This study employs a longitudinal analysis of dark web forums and marketplaces using a dataset of 25,065 websites and 11,403,638 HTML snapshots collected over six years (2020–2026), totaling approximately 1,245 GB of data. The methodology proceeds through three primary stages:

1. Data Preprocessing and Structuring:

   • Website Grouping: Snapshots were grouped by file path and page title to define stable website identities. Groups with fewer than four snapshots were excluded to ensure sufficient temporal depth.
   • Content Extraction: The trafilatura library was used to extract main textual content, removing scripts and navigation elements.
   • Normalization: Text was filtered for English language, lowercased, and stripped of URLs, emails, punctuation, and non-linguistic artifacts. Tokens were lemmatized using WordNet, and stopwords were removed.

2. Topic Discovery Pipeline:

   • Embedding: Documents were converted into semantic vectors using DARK-BERT, a domain-adapted transformer model trained on cybersecurity and darknet corpora, selected over general models (MiniLM, AttackBERT) for superior semantic coherence.
   • Dimensionality Reduction: Uniform Manifold Approximation and Projection (UMAP) reduced embedding dimensions while preserving semantic neighborhood structures.
   • Clustering: HDBSCAN (density-based clustering) identified thematic clusters without pre-specifying the number of topics, treating sparse content as noise.
   • Labeling: Representative keywords were extracted via class-based TF-IDF and KeyBERT. These were fed into Llama-3.1-8B-Instruct to generate human-readable topic labels, which were subsequently manually validated and merged to ensure semantic accuracy.

3. Longitudinal Analysis:

   • Snapshots were assigned probabilistic topic distributions using BERTopic's soft assignment mechanism.
   • Topic probabilities were aggregated across time intervals (quarters) for each website to measure Topic Prevalence (distribution of activity) and Topic Lifecycle (lifespan, growth, and decay rates).

Key Contributions

• Longitudinal Framework: The authors propose a measurement framework for analyzing dark web forums and marketplaces using repeated HTML snapshots, moving beyond static analysis.
• Domain-Specific Pipeline: Development of a topic discovery pipeline integrating DARK-BERT embeddings, density-based clustering, and LLM-assisted labeling to model temporal dynamics.
• Large-Scale Dataset: The study utilizes the largest longitudinal dataset of its kind to date, comprising over 11 million snapshots from more than 25,000 dark web websites collected over six years.
• Open Resources: The authors release their code and resources to support software sustainability.

Results

The analysis identified 55 thematic clusters categorized into four overarching groups: Transactional, Products, Infrastructure, and Community.

• Topic Prevalence (RQ1): Discussion volume is highly concentrated. The top five topics account for 53.15% of total activity, and the top thirteen explain 75%. The most prevalent topics include "Torrents and Files" (15.71%), "Forum Reputation" (13.83%), and "Online Shopping" (8.54%). The ecosystem is dominated by community and transactional activities, which together constitute over 67% of the corpus.
• Topic Lifecycle (RQ2): Contrary to the assumption of rapid thematic turnover, the ecosystem exhibits significant stability.
  • Persistence: The median topic lifespan is 75 months (6.25 years), with a mean of roughly 68 months.
  • Continuity: Approximately 75% of total discussion volume is concentrated in a small set of persistent core topics. Short-lived themes account for only about 3% of activity.
  • Evolution: Changes in thematic prominence occur through gradual growth and decline rather than abrupt emergence or disappearance. Even declining topics typically fade over multiple periods (average lag of 28 months from peak to disappearance) rather than vanishing instantly.
  • Distribution: The distribution of topic lifespans is bimodal, with topics tending to be either continuously active (recurring) or short-lived and sporadic, with few intermediate cases.

Significance and Claims

The paper claims that the dark web cybercrime ecosystem is structurally concentrated and thematically persistent, evolving through gradual shifts in existing topics rather than continuous thematic replacement.

• Strategic Implications for CTI: The findings suggest that cybercrime communities are defined by stable, long-lived functions (e.g., reputation building, transaction protection, infrastructure hosting) rather than novelty. This implies that threat intelligence efforts should shift from reactive monitoring of transient spikes to longitudinal monitoring of persistent core topics.
• Resource Allocation: The authors argue for stratified resource allocation: persistent core topics require continuous automated monitoring, while emerging topics need periodic expert analysis. Short-lived bursts should be treated as temporary fluctuations.
• Enforcement Impact Evaluation: The observed multi-year topic lifespans provide a baseline for distinguishing temporary disruptions (e.g., law enforcement takedowns) from structural changes in the ecosystem.
• Planning Horizons: The stability of the ecosystem supports the adoption of multi-year strategic planning for threat intelligence, moving beyond reactive, short-term responses.

The study concludes that while the dark web is dynamic in terms of platform migration and rebranding, the underlying thematic structure of economically motivated cybercrime remains remarkably stable over time.