BlackWidow: Monitoring the Dark Web for Cyber Security Information

TLDR

The Dark Web hosts hidden services that criminals use to sell illegal goods and information, including zero‑day exploits, stolen credentials, and botnets, making it a valuable source for cyber‑security intelligence. The study examines challenges of gathering Dark Web information for cyber‑security intelligence. BlackWidow is a Docker‑based modular system that automatically monitors Dark Web services, integrates data using preexisting and custom machine‑learning tools, and aggregates it into a unified analytics framework. BlackWidow quickly amassed years of Dark Web data, building a knowledge graph that enables analysts to explore relationships, detect trends, and investigate cases such as leaked data and pre‑malicious activity.

Abstract

The Dark Web, a conglomerate of services hidden from search engines and regular users, is used by cyber criminals to offer all kinds of illegal services and goods. Multiple Dark Web offerings are highly relevant for the cyber security domain in anticipating and preventing attacks, such as information about zero-day exploits, stolen datasets with login information, or botnets available for hire. In this work, we analyze and discuss the challenges related to information gathering in the Dark Web for cyber security intelligence purposes. To facilitate information collection and the analysis of large amounts of unstructured data, we present BlackWidow, a highly automated modular system that monitors Dark Web services and fuses the collected data in a single analytics framework. BlackWidow relies on a Docker-based micro service architecture which permits the combination of both preexisting and customized machine learning tools. BlackWidow represents all extracted data and the corresponding relationships extracted from posts in a large knowledge graph, which is made available to its security analyst users for search and interactive visual exploration. Using BlackWidow, we conduct a study of seven popular services on the Deep and Dark Web across three different languages with almost 100,000 users. Within less than two days of monitoring time, BlackWidow managed to collect years of relevant information in the areas of cyber security and fraud monitoring. We show that BlackWidow can infer relationships between authors and forums and detect trends for cybersecurity-related topics. Finally, we discuss exemplary case studies surrounding leaked data and preparation for malicious activity.