Data Infrastructure Building Blocks for ISI. A Project of the University of Arizona (NSF #ACI-1443019), Drexel University,
University of Virginia, University of Texas at Dallas, and University of Utah
AZSecure-data.org
Dark Net Markets (DNMs)
Dark Net Markets are online cyber criminal platforms used for advertising, buying and selling illegal goods including a significant number of cybersecurity-related tools. Since DNMs are relatively new compared to other platforms, there is more untapped research opportunities in this area. Since shutdown of Alphabay darknet market by FBI, Dream market has been the largest Dark Net Market. Accordingly, the Artificial Intelligence Lab at the University of Arizona has collected this market in 2016 and 2017. This collection contains data about products advertised on Dark Net Markets including (product name, category, description, shipping_options, shipping departure, shipping destination, price, and payment method) and sellers including (seller_name, member_since(date), pgp key, seller's description, feedback rating). Malicious products in DNMs are of significant importance because some of the cyber-security related products advertised on them cannot be found in other platforms such as forums in hacker community. These malicious products can be used by hackers as potential cyber threats to cybersecurity.
- DreamMarket Dark Net Market in 2017 continued to grow and became the largest market after the AlphaBay shutdown. This dataset contains 91,463 product listings from 2092 sellers in 2017. Sellers membership's date ranges from 12/4/2013 - 10/4/2017. The market played role in disseminating stolen credentials of Equifax data breach in 2017. Therefore, this dataset can facilitate research on proactive cyber threat intelligence in order to prevent or mitigate the risk of future data breaches and attacks. Moreover, given the large number of products in this dataset, it facilitates cross-platform studies that focus on supply chain aspects of the threats between forums and DNMs. Such stream of research provides insight about the dissemination patterns and flow of the cyber-security related products. For more information please refer to the ReadMe file below.
- Suggested Analytics: Key Seller identification to recognize sellers with the most impact on these markets, Cyber threat identification via detecting malicious products advertised on DNMs.
- Suggested techniques: Text classification, topic modeling (Latent Dirichlet Allocation), deep learning
- Suggested tools: Scikit-learn, Rapidminer, Weka, Mallet, Gensim
- Suggested Analytics: Key Seller identification to recognize sellers with the most impact on these markets, Cyber threat identification via detecting malicious products advertised on DNMs.
DreamMarket_2017.zip (24.7 MB)
- DreamMarket Dark Net Market in 2016 was among the largest DNMs and ranked in second place in terms of size after the seized market AlphaBay. This DNM contains 39,473 product listings from 690 sellers in 2016. In addition to 2017's collection, this dataset is useful as a complimentary resource for identifying cyber threats and pinpointing key sellers to realize proactive cyber threat intelligence in cybersecurity research. Sellers membership's date ranges from 12/4/2013 to 12/1/2016. For more information please refer to the ReadMe file below.
ReadMe.txt
DreamMarket_2016.zip (11.5 MB)
Dark Net Forums (DNFs)
Dark Net Forums are online cyber criminal platforms that are often associated with the Dark Net Markets. After the international FBI operation in 2017, which temporarily led to the closure of many market places, cyber criminals found it more convenient to interact within anonymous forums. Currently, most DNMs host their own forum in which cyber criminals can support each other and communicate to perform their illegal transactions. We have identified three large-scale DNFs in 2018 and collected the posts created by cyber criminals. Such forums can be used for a variety of cyber threat intelligence tasks and identifying social networks among cyber criminals. Such forums are useful for key Seller identification to recognize sellers with the most impact on these markets, cyber threat identification via detecting malicious products advertised on DNFs, and also putting a face on the administrators of these platforms. This dataset consists of 128,540 posts in English and Russian. Each post has the following fields: post ID, thread ID, thread title, URL, sub_forum, author name, author's membership, author's join date, author's reputation, post date, number of likes, and post content.
DNF_2019.zip (39.5 MB)
Intelligence and Security Informatics Data Sets