Organized Cyber Crime: Algorithms and Methods [Kindle Edition]

Law enforcement agencies reports that Organized Criminal Groups are moving more of their activities from traditional crime into the Cyber Domain. Where they form so-called Darknets, whose purpose is to act as marketplaces for illegal material, products, and services. These activities form a part of the Crime-as-a- Service business model, which drives the digital underground economy by providing services that facilitate almost any type of Cyber Crime. The challenge for law enforcement is knowing which entity to target for effectively taking down these network structures. This thesis seeks to use graph-based algorithms and methods to analyze network structures to identify interesting and relevant individuals within such networks. More specifically, it proposes Social Network Analysis (SNA) methods for the process of identification of such individuals. The thesis analyze each SNA method to identify those methods that identify the most central individuals within a network. Also, it will analyze how the us- age of different graph construction techniques can be applied to the process of identification. The thesis contributions is to try to bridge the gap between law enforcement agencies and Cyber Criminals by proposing an improved way of prioritizing individuals within these networks. Topics covered by the book Anonymization techniques enable users to communicate freely without the risk of being traced, which allow them to host and connect to secret services and forums in parts of the Internet, known as Darknets. These underground forums are being used by Organized Criminal Group (OCG) as marketplaces for illegal material, buying and selling of products and services, and share experience and expertise. These activities, combined with the Crime-as-a-Service (CaaS) business model, drives the digital underground economy by providing services that facilitate almost any type of Cyber Crime. An extensive network of persons that fulfill specific functions build the CaaS business model. For example, a hacker discovers a vulnerability in a software program, which can be sold to another who writes an exploit that uses this vulnerability to take control of vulnerable machines. When the hacker has control of these devices, they can be sold to another hacker who might group them with other compromised machines to form a botnet of remotely controlled computers. The botnet becomes a platform from which Cyber Criminals can hire, to launch attacks against websites or networks. Digital forensic is a process of investigating past events, by collecting, identifying and validating digital information. However, it is essential to gather intelligence about these networks to increase the success of a digital forensic investigation. What is both important and challenging is to filter out uninteresting information, leaving entities of interest for the investigation. With potentially many thousands of online criminals in one underground forum, efficient algorithms and techniques must be used to filter all of the criminal entities.